diff --git a/README.md b/README.md
index ec9ef36..f501ae1 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,12 @@ build configuration, and native integrations.
 
 ## Wallet development
 
+Rust workspaces pin the shared `tx-types` 0.2 transaction core and its matching
+noun runtime to one Git revision. `packages/wallet-engine` and `nockster-esp`
+call the same `tx_types::planner`; their adapters provide RPC note data, wallet envelopes,
+and software or hardware signatures. Composer inputs include the actual
+`note_data` map and an explicit candidate height for time-locked inputs.
+
 Use Node and npm versions matching `package.json`. Install dependencies from
 this directory; npm workspaces share the root lockfile. The Rust engine pins
 its toolchain in `packages/wallet-engine/rust-toolchain.toml`; the desktop
diff --git a/apps/desktop/src-tauri/Cargo.lock b/apps/desktop/src-tauri/Cargo.lock
index 84afd58..0155e68 100644
--- a/apps/desktop/src-tauri/Cargo.lock
+++ b/apps/desktop/src-tauri/Cargo.lock
@@ -2362,7 +2362,7 @@ checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
 
 [[package]]
 name = "nockster-desktop"
-version = "1.2.0"
+version = "1.3.0"
 dependencies = [
  "base64 0.22.1",
  "hidapi",
diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml
index 78ffa57..328cd7e 100644
--- a/apps/desktop/src-tauri/Cargo.toml
+++ b/apps/desktop/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "nockster-desktop"
-version = "1.2.0"
+version = "1.3.0"
 edition = "2021"
 rust-version = "1.90"
 
diff --git a/apps/desktop/src-tauri/tauri.conf.json b/apps/desktop/src-tauri/tauri.conf.json
index 6d17138..8cddf42 100644
--- a/apps/desktop/src-tauri/tauri.conf.json
+++ b/apps/desktop/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Nockster",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "identifier": "io.swps.nockster.desktop",
   "build": {
     "beforeDevCommand": "npm run dev:web",
diff --git a/apps/desktop/src/transactions/Composer.svelte b/apps/desktop/src/transactions/Composer.svelte
index 214fc5b..3d73814 100644
--- a/apps/desktop/src/transactions/Composer.svelte
+++ b/apps/desktop/src/transactions/Composer.svelte
@@ -45,7 +45,8 @@
     commitments: '',
     refundAddress: '',
     refundHeight: '',
-    branch: 'claim'
+    branch: 'claim',
+    preimages: ''
   };
   let outputs = [newOutput(1)];
   let nextOutputId = 2;
@@ -100,7 +101,7 @@
   let selectionTimer: ReturnType<typeof setTimeout> | undefined;
   const composerWorker = createComposerWorker();
   let height = '';
-  let manual = { first: '', last: '', origin: '', amount: '' };
+  let manual = { first: '', last: '', origin: '', amount: '', noteData: '{}' };
   let notesLoading = false;
   let building = false;
   let error = '';
@@ -212,8 +213,9 @@
       if (!alive || request !== noteRequest) return;
       notes = largestNotesFirst(
         loaded
-          .filter(note => Number(note.version) === 1)
+          .filter(note => note.version === '1')
           .map(note => ({
+            note_data: note.noteData,
             name_first: note.firstName,
             name_last: note.lastName,
             origin_page: note.originPage,
@@ -235,6 +237,7 @@
     try {
       const wasm = await hardwareCrypto();
       const note: Note = {
+        note_data: JSON.parse(manual.noteData),
         name_first: manual.first.trim(),
         name_last: manual.last.trim(),
         origin_page: wholeNumber(manual.origin, 'Origin block height'),
@@ -248,7 +251,7 @@
         throw new Error('This note is reserved by a pending transaction.');
       notes = largestNotesFirst([...notes, note]);
       if (selectionMode === 'manual') selected = new Set([...selected, noteId(note)]);
-      manual = { first: '', last: '', origin: '', amount: '' };
+      manual = { first: '', last: '', origin: '', amount: '', noteData: '{}' };
     } catch (failure) {
       noteError = failure instanceof Error ? failure.message : String(failure);
     }
@@ -291,6 +294,7 @@
     const input: ComposeInput = {
       source_pkh: sourceAddress,
       notes: inputNotes,
+      manual_inputs: selectionMode === 'manual',
       outputs: [],
       current_height: wholeNumber(height, 'Current block height', 1)
     };
@@ -309,7 +313,12 @@
           source.refundHeight,
           valid
         ),
-        spend_branch: source.branch === 'claim' ? 0 : 1
+        spend_branch: source.branch === 'claim' ? 0 : 1,
+        preimages: source.preimages
+          .trim()
+          .split(/\s+/)
+          .filter(Boolean)
+          .map(value => Array.from(atob(value), ch => ch.charCodeAt(0)))
       };
     input.outputs = outputs.map((output, index) => {
       try {
@@ -499,6 +508,12 @@
         <label for="htlc-claim"
           >Claim address<input id="htlc-claim" bind:value={source.claimAddress} /></label
         >
+        <label for="htlc-preimages"
+          >Claim preimages (base64 JAM, one per line)<textarea
+            id="htlc-preimages"
+            bind:value={source.preimages}
+          /></label
+        >
         <label for="htlc-commitments"
           >Claim preimage commitments<textarea
             id="htlc-commitments"
@@ -566,6 +581,12 @@
       {#if noteError}<p class="transaction-error" role="alert">{noteError}</p>{/if}
       <details>
         <summary>Add an input note manually</summary>
+        <label for="note-data"
+          >On-chain note data (JSON; {'{}'} for an empty map)<textarea
+            id="note-data"
+            bind:value={manual.noteData}
+          /></label
+        >
         <label for="note-first"
           >First note hash<input id="note-first" bind:value={manual.first} /></label
         >
diff --git a/apps/desktop/src/transactions/composer.ts b/apps/desktop/src/transactions/composer.ts
index 22fefd5..2801579 100644
--- a/apps/desktop/src/transactions/composer.ts
+++ b/apps/desktop/src/transactions/composer.ts
@@ -28,6 +28,7 @@ export type LockForm = {
 };
 export type OutputForm = LockForm & { id: number; amount: string };
 export type Note = {
+  note_data: Record<string, unknown>;
   name_first: string;
   name_last: string;
   origin_page: number;
@@ -45,6 +46,7 @@ export type SourceForm = {
   refundAddress: string;
   refundHeight: string;
   branch: 'claim' | 'refund';
+  preimages: string;
 };
 export type Output = {
   recipient: Recipient;
@@ -58,10 +60,11 @@ export type Output = {
 export type ComposeInput = {
   source_pkh: string;
   source_multisig?: { m: number; pkhs: string[] };
-  source_or_lock?: { branches: LockBranch[]; spend_branch: number };
+  source_or_lock?: { branches: LockBranch[]; spend_branch: number; preimages: number[][] };
   notes: Note[];
   outputs: Output[];
   current_height: number;
+  manual_inputs?: boolean;
 };
 export type ComposeSummary = {
   total_fees: number;
@@ -182,6 +185,10 @@ export function validateNotes(notes: Note[], valid: AddressValidator): Note[] {
   for (const note of notes) {
     address(note.name_first, 'first note hash', valid);
     address(note.name_last, 'last note hash', valid);
+    if (!note.note_data || typeof note.note_data !== 'object' || Array.isArray(note.note_data))
+      throw new Error(
+        'Input note data is missing. Refresh the notes or supply the on-chain note data.'
+      );
     if (note.version !== 1) throw new Error('Select V1 notes for this transaction.');
     if (
       !Number.isSafeInteger(note.assets) ||
diff --git a/apps/desktop/src/transactions/composer.worker.ts b/apps/desktop/src/transactions/composer.worker.ts
index c106a4d..53bfad6 100644
--- a/apps/desktop/src/transactions/composer.worker.ts
+++ b/apps/desktop/src/transactions/composer.worker.ts
@@ -2,39 +2,22 @@ import init, {
   compose_tx_v1_min_inputs,
   is_valid_pkh
 } from '../../../../nockster-esp/crates/nockster-wasm/pkg/nockster_wasm.js';
-import { largestNotesFirst, notesForAmount } from './note-selection';
 import { validateNotes, type ComposeInput, type ComposeSummary } from './composer';
 
 self.onmessage = async (event: MessageEvent<ComposeInput>) => {
   try {
-    const input = event.data;
-    const notes = largestNotesFirst(input.notes);
-    const target = input.outputs.reduce((sum, output) => sum + BigInt(output.amount), 0n);
-    if (notes.reduce((sum, note) => sum + BigInt(note.assets), 0n) <= target)
-      throw new Error('Insufficient funds to cover requested outputs and fee.');
     await init();
-    let count = notesForAmount(notes, target + 1n).length;
-    while (count > 0) {
-      try {
-        const result = compose_tx_v1_min_inputs({
-          ...input,
-          notes: validateNotes(notes.slice(0, count), is_valid_pkh)
-        });
-        try {
-          const bytes = result.wallet_jam;
-          const summary: ComposeSummary = JSON.parse(result.summary_json);
-          self.postMessage({ bytes, summary, txId: result.tx_id });
-          return;
-        } finally {
-          result.free();
-        }
-      } catch (failure) {
-        const message = failure instanceof Error ? failure.message : String(failure);
-        if (!message.includes('insufficient funds') || count === notes.length) throw failure;
-        count = Math.min(notes.length, Math.max(count + 1, count * 2));
-      }
+    const input = event.data;
+    const result = compose_tx_v1_min_inputs({
+      ...input,
+      notes: validateNotes(input.notes, is_valid_pkh)
+    });
+    try {
+      const summary: ComposeSummary = JSON.parse(result.summary_json);
+      self.postMessage({ bytes: result.wallet_jam, summary, txId: result.tx_id });
+    } finally {
+      result.free();
     }
-    throw new Error('No spendable notes are available.');
   } catch (failure) {
     self.postMessage({ error: failure instanceof Error ? failure.message : String(failure) });
   }
diff --git a/apps/mobile/ios/App/App.xcodeproj/project.pbxproj b/apps/mobile/ios/App/App.xcodeproj/project.pbxproj
index 1320e36..00a3231 100644
--- a/apps/mobile/ios/App/App.xcodeproj/project.pbxproj
+++ b/apps/mobile/ios/App/App.xcodeproj/project.pbxproj
@@ -327,7 +327,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.2.0;
+				MARKETING_VERSION = 1.3.0;
 				OTHER_SWIFT_FLAGS = "$(inherited) \"-D\" \"COCOAPODS\" \"-DDEBUG\"";
 				PRODUCT_BUNDLE_IDENTIFIER = io.swps.nockster;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -349,7 +349,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.2.0;
+				MARKETING_VERSION = 1.3.0;
 				PRODUCT_BUNDLE_IDENTIFIER = io.swps.nockster;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "";
diff --git a/nockster-esp/Cargo.lock b/nockster-esp/Cargo.lock
index 31a23a4..df2741d 100644
--- a/nockster-esp/Cargo.lock
+++ b/nockster-esp/Cargo.lock
@@ -2813,7 +2813,7 @@ dependencies = [
 [[package]]
 name = "ibig"
 version = "0.3.6"
-source = "git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "cfg-if",
  "num-traits",
@@ -3535,7 +3535,7 @@ dependencies = [
 [[package]]
 name = "murmur3"
 version = "0.5.2"
-source = "git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 
 [[package]]
 name = "nb"
@@ -3627,7 +3627,7 @@ dependencies = [
 [[package]]
 name = "nockapp"
 version = "0.1.0"
-source = "git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "bincode",
  "bitvec",
@@ -3642,10 +3642,10 @@ dependencies = [
 [[package]]
 name = "nockchain-libp2p-io"
 version = "0.1.0"
-source = "git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "bs58",
- "ibig 0.3.6 (git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52)",
+ "ibig 0.3.6 (git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e)",
  "nockapp",
  "nockvm",
  "noun-serde",
@@ -3654,14 +3654,14 @@ dependencies = [
 [[package]]
 name = "nockchain-math"
 version = "0.1.0"
-source = "git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "arrayref",
  "bs58",
  "bytes",
  "either",
  "hex-literal 1.1.0",
- "ibig 0.3.6 (git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52)",
+ "ibig 0.3.6 (git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e)",
  "nockapp",
  "nockvm",
  "nockvm_macros",
@@ -3676,7 +3676,7 @@ dependencies = [
 
 [[package]]
 name = "nockster-cli"
-version = "0.3.0"
+version = "0.4.0"
 dependencies = [
  "anstream",
  "anstyle",
@@ -3722,7 +3722,7 @@ dependencies = [
 
 [[package]]
 name = "nockster-core"
-version = "0.3.0"
+version = "0.4.0"
 dependencies = [
  "bip32",
  "bip39",
@@ -3747,7 +3747,7 @@ dependencies = [
 
 [[package]]
 name = "nockster-fw"
-version = "0.3.0"
+version = "0.4.0"
 dependencies = [
  "aes-gcm",
  "bip32",
@@ -3787,7 +3787,7 @@ dependencies = [
 
 [[package]]
 name = "nockster-fw-emu"
-version = "0.3.0"
+version = "0.4.0"
 dependencies = [
  "console_error_panic_hook",
  "embedded-graphics",
@@ -3805,7 +3805,7 @@ dependencies = [
 
 [[package]]
 name = "nockster-pc"
-version = "0.2.1"
+version = "0.3.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -3820,7 +3820,7 @@ dependencies = [
 
 [[package]]
 name = "nockster-wasm"
-version = "0.3.0"
+version = "0.4.0"
 dependencies = [
  "bs58",
  "bytes",
@@ -3843,13 +3843,13 @@ dependencies = [
 [[package]]
 name = "nockvm"
 version = "0.1.0"
-source = "git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "autotools",
  "bitvec",
  "cc",
  "either",
- "ibig 0.3.6 (git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52)",
+ "ibig 0.3.6 (git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e)",
  "intmap",
  "json",
  "lazy_static",
@@ -3869,7 +3869,7 @@ dependencies = [
 [[package]]
 name = "nockvm_macros"
 version = "0.1.0"
-source = "git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "quote",
  "syn 2.0.111",
@@ -3884,7 +3884,7 @@ checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb"
 [[package]]
 name = "noun-serde"
 version = "0.1.0"
-source = "git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "nockapp",
  "nockvm",
@@ -3896,7 +3896,7 @@ dependencies = [
 [[package]]
 name = "noun-serde-derive"
 version = "0.1.0"
-source = "git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "nockvm",
  "proc-macro2",
@@ -4578,8 +4578,8 @@ dependencies = [
 
 [[package]]
 name = "pokenoun"
-version = "0.1.0"
-source = "git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+version = "0.2.0"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 
 [[package]]
 name = "polyval"
@@ -6659,17 +6659,18 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "tx-types"
-version = "0.1.0"
-source = "git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+version = "0.2.0"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "anyhow",
+ "base64 0.22.1",
  "bip39",
  "bs58",
  "bytes",
  "chrono",
  "either",
  "hmac",
- "ibig 0.3.6 (git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52)",
+ "ibig 0.3.6 (git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e)",
  "nockapp",
  "nockchain-libp2p-io",
  "nockchain-math",
@@ -6920,8 +6921,8 @@ checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
 [[package]]
 name = "vanity"
-version = "0.1.0"
-source = "git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+version = "0.2.0"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "bip39",
  "bs58",
@@ -8031,14 +8032,14 @@ dependencies = [
 [[package]]
 name = "zkvm-jetpack"
 version = "0.1.0"
-source = "git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "bitvec",
  "bs58",
  "bytes",
  "either",
  "hex-literal 1.1.0",
- "ibig 0.3.6 (git+https://github.com/SWPSCO/tx-types.git?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52)",
+ "ibig 0.3.6 (git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e)",
  "nockapp",
  "nockchain-math",
  "nockvm",
diff --git a/nockster-esp/Cargo.toml b/nockster-esp/Cargo.toml
index bbd549c..aac980c 100644
--- a/nockster-esp/Cargo.toml
+++ b/nockster-esp/Cargo.toml
@@ -7,12 +7,19 @@ members = [
     "crates/nockster-fw-emu",
     "src-tauri",
 ]
+# Firmware and the GUI emulator use their explicit Xtensa and WASM targets.
+default-members = [
+    "crates/nockster-core",
+    "crates/nockster-cli",
+    "crates/nockster-wasm",
+    "src-tauri",
+]
 resolver = "2"
 
 [workspace.package]
 authors = ["Southwestern Pool Supply Co", "SWPSCo <howdy@swps.io>"]
 edition = "2021"
-version = "0.3.0"
+version = "0.4.0"
 
 [profile.release]
 codegen-units = 1
@@ -77,21 +84,20 @@ postgrest = "1.0.1"
 proc-macro2 = "1.0.95"
 either = "1.13"
 
-# nockchain / tx-types pins
-# nockchain = { git = "https://github.com/swpsco/nockchain.git", rev = "a7daa6d5a5c85106428bab76132eb28218828dfd", package = "nockchain" }
-nockvm = { git = "https://github.com/SWPSCO/tx-types.git", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52", default-features = false }
-nockapp = { git = "https://github.com/SWPSCO/tx-types.git", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52", default-features = false }
-zkvm-jetpack = { git = "https://github.com/SWPSCO/tx-types.git", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52" }
-nockvm_macros = { git = "https://github.com/SWPSCO/tx-types.git", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52" }
-nockchain-libp2p-io = { git = "https://github.com/SWPSCO/tx-types.git", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52", default-features = false }
-nockchain-math = { git = "https://github.com/SWPSCO/tx-types.git", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52", default-features = false }
-murmur3 = { git = "https://github.com/SWPSCO/tx-types.git", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52" }
+# Shared transaction core and its matching noun runtime
+nockvm = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e", default-features = false }
+nockapp = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e", default-features = false }
+zkvm-jetpack = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e" }
+nockvm_macros = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e" }
+nockchain-libp2p-io = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e", default-features = false }
+nockchain-math = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e", default-features = false }
+murmur3 = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e" }
 # kernels = { git = "https://github.com/swpsco/nockchain.git", rev = "a7daa6d5a5c85106428bab76132eb28218828dfd", package = "kernels" }
-noun-serde-derive = { git = "https://github.com/SWPSCO/tx-types.git", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52" }
-noun-serde = { git = "https://github.com/SWPSCO/tx-types.git", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52" }
-tx-types = { git = "https://github.com/SWPSCO/tx-types.git", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52", default-features = false }
-vanity = { git = "https://github.com/SWPSCO/tx-types.git", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52", default-features = false }
-pokenoun = { git = "https://github.com/SWPSCO/tx-types.git", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52" }
-ibig = { git = "https://github.com/SWPSCO/tx-types.git", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52", default-features = false }
+noun-serde-derive = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e" }
+noun-serde = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e" }
+tx-types = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e", default-features = false }
+vanity = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e", default-features = false }
+pokenoun = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e" }
+ibig = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e", default-features = false }
 
 [workspace.lints.rust]
diff --git a/nockster-esp/Makefile b/nockster-esp/Makefile
index 02dce0d..64813bc 100644
--- a/nockster-esp/Makefile
+++ b/nockster-esp/Makefile
@@ -924,7 +924,9 @@ monitor:
 	espflash monitor --port /dev/$$DEV
 
 check:
-	@cargo check --workspace
+	@cargo check
+	@cargo check -p nockster-fw-emu --target wasm32-unknown-unknown
+	@cargo +esp -Zbuild-std=core,alloc check -p nockster-fw --target $(TARGET_ESP)
 
 clippy:
 	@cargo clippy --workspace -- -D warnings
diff --git a/nockster-esp/README.md b/nockster-esp/README.md
index 9fe1e67..ca6ac30 100644
--- a/nockster-esp/README.md
+++ b/nockster-esp/README.md
@@ -5,6 +5,19 @@ signing Nockchain transactions on an [ESP32-S3-Touch-LCD-1.47](https://www.waves
 
 https://github.com/user-attachments/assets/374c7e70-3651-4e75-a942-28b4d5cc9d79
 
+## Development checks
+
+The workspace pins `tx-types` 0.2 and its noun runtime to one Git revision.
+`cargo check` checks the host crates; first run `npm run build` in `web`
+to prepare the desktop frontend assets. `make check` also checks the GUI emulator
+for `wasm32-unknown-unknown` and the firmware with the `esp` toolchain for
+`xtensa-esp32s3-none-elf`. Install those toolchains/targets before running it.
+
+Transaction planning, lock proofs, note-data commitments, and fee accounting
+come from `tx-types` in both the browser composer and the firmware signing core.
+The public signing fixture is regenerated with
+`node ../scripts/update-signing-fixture.mjs` after rebuilding the wallet WASM.
+
 ## Features
 
 - On-device seed storage, transaction review, approval, and signing.
diff --git a/nockster-esp/crates/nockster-cli/Cargo.toml b/nockster-esp/crates/nockster-cli/Cargo.toml
index 7fe20d7..fb12c96 100644
--- a/nockster-esp/crates/nockster-cli/Cargo.toml
+++ b/nockster-esp/crates/nockster-cli/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "nockster-cli"
 authors = ["Southwestern Pool Supply Co", "SWPSCo <howdy@swps.io>"]
-version = "0.3.0"
+version = "0.4.0"
 edition = "2021"
 
 [dependencies]
diff --git a/nockster-esp/crates/nockster-core/Cargo.toml b/nockster-esp/crates/nockster-core/Cargo.toml
index 5b3e024..6b41c1c 100644
--- a/nockster-esp/crates/nockster-core/Cargo.toml
+++ b/nockster-esp/crates/nockster-core/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "nockster-core"
 authors = ["Southwestern Pool Supply Co", "SWPSCo <howdy@swps.io>"]
-version = "0.3.0"
+version = "0.4.0"
 edition = "2021"
 
 [lib]
diff --git a/nockster-esp/crates/nockster-core/examples/sign_test_fixture.rs b/nockster-esp/crates/nockster-core/examples/sign_test_fixture.rs
new file mode 100644
index 0000000..f160349
--- /dev/null
+++ b/nockster-esp/crates/nockster-core/examples/sign_test_fixture.rs
@@ -0,0 +1,25 @@
+//! Sign a public test fixture with the same entry point as the firmware.
+use nockster_core::draft_sign::{sign_draft_v1_with_policy, FeePolicy, SignerConfig};
+
+fn main() {
+    let args: Vec<_> = std::env::args().collect();
+    assert_eq!(
+        args.len(),
+        4,
+        "sign_test_fixture INPUT.jam OUTPUT.jam HEIGHT"
+    );
+    let height: u64 = args[3].parse().expect("candidate height");
+    let (sk_be, _) = nockster_core::cheetah::master_from_mnemonic(
+        "fluid ordinary worth width spatial program evoke defense fade unveil large dress comfort reason invest urge step fitness bleak worth pole eagle gap float",
+        "",
+    );
+    let draft = std::fs::read(&args[1]).expect("read draft");
+    let signed = sign_draft_v1_with_policy(
+        &draft,
+        &SignerConfig { sk_be },
+        height,
+        FeePolicy::default(),
+    )
+    .expect("sign public test fixture");
+    std::fs::write(&args[2], signed).expect("write signed fixture");
+}
diff --git a/nockster-esp/crates/nockster-core/src/draft_sign/tip5.rs b/nockster-esp/crates/nockster-core/src/draft_sign/tip5.rs
index fd1cbba..37834d7 100644
--- a/nockster-esp/crates/nockster-core/src/draft_sign/tip5.rs
+++ b/nockster-esp/crates/nockster-core/src/draft_sign/tip5.rs
@@ -1 +1 @@
-pub use pokenoun::{hash_noun_varlen, hash_ten_cell, Tip5Error, GOLDILOCKS_P};
+pub use pokenoun::{hash_noun_varlen, Tip5Error, GOLDILOCKS_P};
diff --git a/nockster-esp/crates/nockster-core/src/draft_sign/tx_v1.rs b/nockster-esp/crates/nockster-core/src/draft_sign/tx_v1.rs
index fd211b1..f641f55 100644
--- a/nockster-esp/crates/nockster-core/src/draft_sign/tx_v1.rs
+++ b/nockster-esp/crates/nockster-core/src/draft_sign/tx_v1.rs
@@ -2,6 +2,7 @@ extern crate alloc;
 
 use alloc::string::String;
 use alloc::vec::Vec;
+use tx_types::pokenoun::codec::Decode;
 
 use crate::draft_sign::noun_codec::{cue, jam, Arena, CodecError, Noun};
 use crate::draft_sign::tip5;
@@ -15,7 +16,10 @@ pub enum SignDraftError {
     Malformed,
     Unsupported,
     /// The draft's summed spend fee is below the minimum for its page.
-    FeeBelowMinimum { minimum: u64, provided: u64 },
+    FeeBelowMinimum {
+        minimum: u64,
+        provided: u64,
+    },
 }
 
 impl From<CodecError> for SignDraftError {
@@ -142,20 +146,7 @@ pub const LOCK_MERKLE_AXIS_HASH_B58: &str =
     "6mhCSwJQDvbkbiPAUNjetJtVoo1VLtEhmEYoU4hmdGd6ep1F6ayaV4A";
 const LOCK_MERKLE_PROOF_FULL_TAG: &[u8] = b"full";
 
-// Fee constants come from tx-types whenever it is compiled (std builds:
-// CLI, wasm, tests). The firmware no_std build cannot see the std-gated
-// `tx_types::fee_calculator`, so it mirrors the same blockchain-constants
-// values here; everything else takes a `FeePolicy` from the host instead.
-#[cfg(feature = "std")]
-pub use tx_types::fee_calculator::{BASE_FEE, BYTHOS_PHASE, INPUT_FEE_DIVISOR, MIN_FEE};
-#[cfg(not(feature = "std"))]
-pub const BYTHOS_PHASE: u64 = 54_000;
-#[cfg(not(feature = "std"))]
-pub const BASE_FEE: u64 = 16_384;
-#[cfg(not(feature = "std"))]
-pub const INPUT_FEE_DIVISOR: u64 = 4;
-#[cfg(not(feature = "std"))]
-pub const MIN_FEE: u64 = 256;
+pub use tx_types::fee::{BASE_FEE, BYTHOS_PHASE, INPUT_FEE_DIVISOR, MIN_FEE};
 
 /// Height-dependent fee policy (mirrors the wasm composer's policy and the
 /// chain's `blockchain-constants`). Hosts pass overrides from chain config;
@@ -334,28 +325,6 @@ fn parse_hash(noun: Noun, arena: &Arena) -> Option<[u64; 5]> {
     ])
 }
 
-fn hashable_noun_digest(noun: Noun, arena: &Arena) -> Result<[u64; 5], SignDraftError> {
-    match noun {
-        Noun::Atom(_) => Ok(tip5::hash_noun_varlen(noun, arena)?),
-        Noun::Cell(id) => {
-            let cell = arena.cell(id);
-            let lh = hashable_noun_digest(cell.head, arena)?;
-            let rh = hashable_noun_digest(cell.tail, arena)?;
-            Ok(tip5::hash_ten_cell(lh, rh)?)
-        }
-    }
-}
-
-fn count_leaves(noun: Noun, arena: &Arena) -> u64 {
-    match noun {
-        Noun::Atom(_) => 1,
-        Noun::Cell(id) => {
-            let cell = arena.cell(id);
-            count_leaves(cell.head, arena).saturating_add(count_leaves(cell.tail, arena))
-        }
-    }
-}
-
 fn decompose_map(map: Noun, arena: &Arena) -> Option<(Noun, Noun, Noun)> {
     let (node, tail) = uncons(map, arena)?;
     if let Some((left, right)) = uncons(tail, arena) {
@@ -369,124 +338,18 @@ fn decompose_pair(pair: Noun, arena: &Arena) -> Option<(Noun, Noun)> {
     uncons(pair, arena)
 }
 
-fn merge_note_data_into(
-    arena: &mut Arena,
-    src: Noun,
-    dst: &mut Noun,
-) -> Result<(), SignDraftError> {
-    if src == arena.atom0() {
-        return Ok(());
-    }
-    let (node, left, right) = decompose_map(src, arena).ok_or(SignDraftError::Malformed)?;
-    let (key, value) = decompose_pair(node, arena).ok_or(SignDraftError::Malformed)?;
-    *dst = zmap::canonical_zmap_put(arena, *dst, key, value)?;
-    merge_note_data_into(arena, left, dst)?;
-    merge_note_data_into(arena, right, dst)
-}
-
 /// Hoon's `num-of-leaves` over `(~(rep z-by note-data) |=([[k v] tree]
 /// [k v tree]))`: each entry contributes its key and value leaves and the
 /// accumulator's terminal `~` contributes one more, i.e. `2n+1` for `n`
 /// atom-valued entries. Counting the z-map noun itself gives `3n+1`.
+#[cfg(test)]
 fn count_note_data_words(note_data: Noun, arena: &Arena) -> Result<u64, SignDraftError> {
-    let mut words = 1u64;
-    count_note_data_words_into(note_data, arena, &mut words)?;
-    Ok(words)
-}
-
-fn count_note_data_words_into(
-    map: Noun,
-    arena: &Arena,
-    words: &mut u64,
-) -> Result<(), SignDraftError> {
-    if map == arena.atom0() {
-        return Ok(());
-    }
-    let (node, left, right) = decompose_map(map, arena).ok_or(SignDraftError::Malformed)?;
-    let (key, value) = decompose_pair(node, arena).ok_or(SignDraftError::Malformed)?;
-    *words = words
-        .checked_add(count_leaves(key, arena))
-        .and_then(|w| w.checked_add(count_leaves(value, arena)))
-        .ok_or(SignDraftError::Malformed)?;
-    count_note_data_words_into(left, arena, words)?;
-    count_note_data_words_into(right, arena, words)
-}
-
-fn collect_seed_note_data_for_fee(
-    arena: &mut Arena,
-    seeds: Noun,
-    merged: &mut Vec<([u64; 5], Noun)>,
-    legacy_seed_words: &mut u64,
-    bythos_active: bool,
-) -> Result<(), SignDraftError> {
-    if seeds == arena.atom0() {
-        return Ok(());
-    }
-
-    let (seed, lr) = uncons(seeds, arena).ok_or(SignDraftError::Malformed)?;
-    let (left, right) = uncons(lr, arena).ok_or(SignDraftError::Malformed)?;
-    let (_output_source, lock_root_noun, note_data, _gift, _parent_hash) =
-        tuple5(seed, arena).ok_or(SignDraftError::Malformed)?;
-    let lock_root = parse_hash(lock_root_noun, arena).ok_or(SignDraftError::Malformed)?;
-
-    if bythos_active {
-        if let Some((_root, data)) = merged.iter_mut().find(|(root, _)| *root == lock_root) {
-            merge_note_data_into(arena, note_data, data)?;
-        } else {
-            let mut data = arena.atom0();
-            merge_note_data_into(arena, note_data, &mut data)?;
-            merged.push((lock_root, data));
-        }
-    } else {
-        *legacy_seed_words = legacy_seed_words
-            .checked_add(count_note_data_words(note_data, arena)?)
-            .ok_or(SignDraftError::Malformed)?;
-    }
-
-    collect_seed_note_data_for_fee(arena, left, merged, legacy_seed_words, bythos_active)?;
-    collect_seed_note_data_for_fee(arena, right, merged, legacy_seed_words, bythos_active)
+    let data =
+        tx_types::NoteData::decode(note_data, arena).map_err(|_| SignDraftError::Malformed)?;
+    tx_types::word_count::note_data_words(&data).map_err(|_| SignDraftError::Malformed)
 }
 
 #[allow(clippy::too_many_arguments)]
-fn collect_spend_words_for_fee(
-    arena: &mut Arena,
-    spends: Noun,
-    merged: &mut Vec<([u64; 5], Noun)>,
-    legacy_seed_words: &mut u64,
-    witness_words: &mut u64,
-    bythos_active: bool,
-) -> Result<(), SignDraftError> {
-    if spends == arena.atom0() {
-        return Ok(());
-    }
-
-    let (node, left, right) = decompose_map(spends, arena).ok_or(SignDraftError::Malformed)?;
-    let (_name, spend) = decompose_pair(node, arena).ok_or(SignDraftError::Malformed)?;
-    let (ver, body) = tuple2(spend, arena).ok_or(SignDraftError::Malformed)?;
-    if noun_atom_u64(ver, arena) != Some(1) {
-        return Err(SignDraftError::Unsupported);
-    }
-    let (witness, seeds, _fee) = tuple3(body, arena).ok_or(SignDraftError::Malformed)?;
-    *witness_words = witness_words.saturating_add(count_leaves(witness, arena));
-    collect_seed_note_data_for_fee(arena, seeds, merged, legacy_seed_words, bythos_active)?;
-
-    collect_spend_words_for_fee(
-        arena,
-        left,
-        merged,
-        legacy_seed_words,
-        witness_words,
-        bythos_active,
-    )?;
-    collect_spend_words_for_fee(
-        arena,
-        right,
-        merged,
-        legacy_seed_words,
-        witness_words,
-        bythos_active,
-    )
-}
 
 /// Minimum fee at `page_num` under `policy`, matching `tx-types`
 /// `calculate_min_fee_for_page` / Hoon `meets-min-fee`.
@@ -496,52 +359,22 @@ pub fn calculate_minimum_fee_v1(
     page_num: u64,
     policy: &FeePolicy,
 ) -> Result<u64, SignDraftError> {
-    let bythos_active = page_num >= policy.bythos_phase;
-    let mut merged = Vec::<([u64; 5], Noun)>::new();
-    let mut legacy_seed_words = 0u64;
-    let mut witness_words = 0u64;
-    collect_spend_words_for_fee(
-        arena,
-        spends,
-        &mut merged,
-        &mut legacy_seed_words,
-        &mut witness_words,
-        bythos_active,
-    )?;
-
-    let seed_words = if bythos_active {
-        let mut total = 0u64;
-        for (_root, note_data) in merged.iter() {
-            total = total
-                .checked_add(count_note_data_words(*note_data, arena)?)
-                .ok_or(SignDraftError::Malformed)?;
-        }
-        total
-    } else {
-        legacy_seed_words
-    };
-
-    let effective_base_fee = if bythos_active {
-        policy.base_fee
-    } else {
-        policy.base_fee.saturating_mul(2)
-    };
-    let witness_divisor = if bythos_active {
-        policy.input_fee_divisor.max(1)
-    } else {
-        1
-    };
-    let seed_fee = seed_words
-        .checked_mul(effective_base_fee)
-        .ok_or(SignDraftError::Malformed)?;
-    let witness_fee = witness_words
-        .checked_mul(effective_base_fee)
-        .ok_or(SignDraftError::Malformed)?
-        / witness_divisor;
-    Ok(seed_fee
-        .checked_add(witness_fee)
-        .ok_or(SignDraftError::Malformed)?
-        .max(policy.min_fee))
+    let spends =
+        tx_types::SpendsV1::decode(spends, arena).map_err(|_| SignDraftError::Malformed)?;
+    tx_types::fee_calculator::calculate_fee(
+        &spends.map,
+        tx_types::fee::FeeInputs {
+            seed_words: 0,
+            witness_words: 0,
+            height: page_num,
+            bythos_phase: policy.bythos_phase,
+            base_fee: policy.base_fee,
+            input_fee_divisor: policy.input_fee_divisor,
+            min_fee: policy.min_fee,
+        },
+    )
+    .map(|fee| fee.minimum_fee)
+    .map_err(|_| SignDraftError::Malformed)
 }
 
 fn spend_fee_total(spends: Noun, arena: &Arena) -> Result<u64, SignDraftError> {
@@ -575,96 +408,13 @@ fn enforce_minimum_fee(
     Ok(())
 }
 
-fn hash_note_data(map: Noun, arena: &Arena) -> Result<[u64; 5], SignDraftError> {
-    // note-data hashable: empty map hashes as leaf+0
-    if map == arena.atom0() {
-        return Ok(tip5::hash_noun_varlen(arena.atom0(), arena)?);
-    }
-
-    let (node, left, right) = decompose_map(map, arena).ok_or(SignDraftError::Malformed)?;
-    let (key, value) = decompose_pair(node, arena).ok_or(SignDraftError::Malformed)?;
-
-    let key_digest = tip5::hash_noun_varlen(key, arena)?;
-    let value_digest = hashable_noun_digest(value, arena)?;
-    let node_digest = tip5::hash_ten_cell(key_digest, value_digest)?;
-
-    let left_digest = hash_note_data(left, arena)?;
-    let right_digest = hash_note_data(right, arena)?;
-    let children_digest = tip5::hash_ten_cell(left_digest, right_digest)?;
-    Ok(tip5::hash_ten_cell(node_digest, children_digest)?)
-}
-
-fn hash_source_hashable(source: Noun, arena: &Arena) -> Result<[u64; 5], SignDraftError> {
-    // Source noun: [p=is_hash is_coinbase=bool]
-    let (p_noun, is_coinbase_noun) = tuple2(source, arena).ok_or(SignDraftError::Malformed)?;
-    let p = parse_hash(p_noun, arena).ok_or(SignDraftError::Malformed)?;
-    let is_coinbase = noun_atom_u64(is_coinbase_noun, arena).ok_or(SignDraftError::Malformed)?;
-    if is_coinbase > 1 {
-        return Err(SignDraftError::Malformed);
-    }
-
-    // Hashable(source) = [hash+p leaf+bool]
-    let bool_digest = tip5::hash_noun_varlen(is_coinbase_noun, arena)?;
-    Ok(tip5::hash_ten_cell(p, bool_digest)?)
-}
-
-fn hash_output_source_unit(output_source: Noun, arena: &Arena) -> Result<[u64; 5], SignDraftError> {
-    // Option<Source> noun:
-    // - None: 0
-    // - Some: [0 source]
-    if output_source == arena.atom0() {
-        return Ok(tip5::hash_noun_varlen(arena.atom0(), arena)?);
-    }
-    let (tag, src) = tuple2(output_source, arena).ok_or(SignDraftError::Malformed)?;
-    if noun_atom_u64(tag, arena) != Some(0) {
-        return Err(SignDraftError::Malformed);
-    }
-
-    let null_digest = tip5::hash_noun_varlen(arena.atom0(), arena)?;
-    let src_digest = hash_source_hashable(src, arena)?;
-    Ok(tip5::hash_ten_cell(null_digest, src_digest)?)
-}
-
-fn hash_seed_sig_hashable(seed: Noun, arena: &Arena) -> Result<[u64; 5], SignDraftError> {
-    let (output_source, lock_root_noun, note_data_noun, gift_noun, parent_hash_noun) =
-        tuple5(seed, arena).ok_or(SignDraftError::Malformed)?;
-
-    let d1 = hash_output_source_unit(output_source, arena)?;
-    let d2 = parse_hash(lock_root_noun, arena).ok_or(SignDraftError::Malformed)?;
-    let note_data_hash = hash_note_data(note_data_noun, arena)?;
-    let d3 = note_data_hash;
-    let d4 = tip5::hash_noun_varlen(gift_noun, arena)?;
-    let d5 = parse_hash(parent_hash_noun, arena).ok_or(SignDraftError::Malformed)?;
-
-    // cell-chain fold from the right: [d1 [d2 [d3 [d4 d5]]]]
-    let mut acc = d5;
-    acc = tip5::hash_ten_cell(d4, acc)?;
-    acc = tip5::hash_ten_cell(d3, acc)?;
-    acc = tip5::hash_ten_cell(d2, acc)?;
-    acc = tip5::hash_ten_cell(d1, acc)?;
-    Ok(acc)
-}
-
-fn hash_seeds_sig(seeds_zset: Noun, arena: &Arena) -> Result<[u64; 5], SignDraftError> {
-    if seeds_zset == arena.atom0() {
-        return Ok(tip5::hash_noun_varlen(arena.atom0(), arena)?);
-    }
-
-    let (seed, lr) = uncons(seeds_zset, arena).ok_or(SignDraftError::Malformed)?;
-    let (left, right) = uncons(lr, arena).ok_or(SignDraftError::Malformed)?;
-
-    let node_digest = hash_seed_sig_hashable(seed, arena)?;
-    let left_digest = hash_seeds_sig(left, arena)?;
-    let right_digest = hash_seeds_sig(right, arena)?;
-    let children_digest = tip5::hash_ten_cell(left_digest, right_digest)?;
-    Ok(tip5::hash_ten_cell(node_digest, children_digest)?)
-}
-
 fn spend_v1_sig_hash(spend_body: Noun, arena: &Arena) -> Result<[u64; 5], SignDraftError> {
-    let (_witness, seeds, fee) = tuple3(spend_body, arena).ok_or(SignDraftError::Malformed)?;
-    let seeds_digest = hash_seeds_sig(seeds, arena)?;
-    let fee_digest = tip5::hash_noun_varlen(fee, arena)?;
-    Ok(tip5::hash_ten_cell(seeds_digest, fee_digest)?)
+    let spend =
+        tx_types::SpendV1::decode(spend_body, arena).map_err(|_| SignDraftError::Malformed)?;
+    spend
+        .compute_sig_hash()
+        .map(|hash| hash.values)
+        .map_err(|_| SignDraftError::Malformed)
 }
 
 fn sign_spend_v1(
@@ -1017,25 +767,6 @@ fn zmap_rebuild_skipping_key(
     Ok(())
 }
 
-struct TxIdCtx {
-    null_digest: [u64; 5],
-    version_digest: [u64; 5],
-    /// `LOCK_MERKLE_AXIS_HASH`, decoded from its canonical base58 spelling.
-    axis_digest: [u64; 5],
-}
-
-fn tx_id_ctx(arena: &mut Arena) -> Result<TxIdCtx, SignDraftError> {
-    let null_digest = tip5::hash_noun_varlen(arena.atom0(), arena)?;
-    let version_atom = arena.alloc_atom_u64(1);
-    let version_digest = tip5::hash_noun_varlen(version_atom, arena)?;
-    let axis_digest = digest_from_b58(LOCK_MERKLE_AXIS_HASH_B58)?;
-    Ok(TxIdCtx {
-        null_digest,
-        version_digest,
-        axis_digest,
-    })
-}
-
 fn mul_add_limbs_le(acc: &mut Vec<u64>, mul: u64, add: u64) {
     let mut carry = add as u128;
     for limb in acc.iter_mut() {
@@ -1155,7 +886,7 @@ mod fee_word_tests {
         // Two atom-valued entries: 2n + 1 = 5 word leaves (Hoon `num-of-leaves`).
         assert_eq!(count_note_data_words(map, &arena).expect("words"), 5);
         // The z-map noun itself has 3n + 1 = 7 leaves: the old over-count.
-        assert_eq!(count_leaves(map, &arena), 7);
+        assert_eq!(tx_types::word_count::noun_words(map, &arena).unwrap(), 7);
         assert_eq!(count_note_data_words(null, &arena).expect("empty"), 1);
 
         let cell_key = arena.alloc_atom_bytes(b"tree");
@@ -1226,9 +957,13 @@ mod message_tests {
 /// Tip5 `hash-noun` digest of a jammed noun — the value a `%hax` lock commits
 /// to on-chain for this preimage (tx-engine: `(hash-noun:hax pre)`).
 pub fn noun_commitment_v1(preimage_jam: &[u8]) -> Result<[u64; 5], SignDraftError> {
-    let mut arena = Arena::new();
-    let root = cue(preimage_jam, &mut arena)?;
-    Ok(tip5::hash_noun_varlen(root, &arena)?)
+    let noun = tx_types::UntypedNoun {
+        p: preimage_jam.to_vec().into(),
+    };
+    let hashable = noun.to_hashable().map_err(|_| SignDraftError::Malformed)?;
+    tx_types::hash_hashable(&hashable)
+        .map(|hash| hash.values)
+        .map_err(|_| SignDraftError::Malformed)
 }
 
 /// Base58 rendering of a Tip5 digest, matching the chain's hash encoding.
@@ -1262,323 +997,22 @@ pub fn cheetah_pubkey_pkh_lock_root_v1(
     let tag = arena.alloc_atom_bytes(b"pkh");
     let primitive = build_tuple(&mut arena, &[tag, body]);
     let spend_condition = arena.alloc_cell(primitive, nil);
-    let ctx = tx_id_ctx(&mut arena)?;
-    let lock_root = hash_lock_primitives_list(spend_condition, &arena, &ctx)?;
+    let lock_root = hash_lock_primitives_list(spend_condition, &arena)?;
     Ok(digest_to_b58(lock_root))
 }
 
-fn hash_nname_hashable(noun: Noun, arena: &Arena) -> Result<[u64; 5], SignDraftError> {
-    let (first_noun, rest) = uncons(noun, arena).ok_or(SignDraftError::Malformed)?;
-    let (second_noun, end) = uncons(rest, arena).ok_or(SignDraftError::Malformed)?;
-    let first = parse_hash(first_noun, arena).ok_or(SignDraftError::Malformed)?;
-    let second = parse_hash(second_noun, arena).ok_or(SignDraftError::Malformed)?;
-    let end_digest = tip5::hash_noun_varlen(end, arena)?;
-    let tail = tip5::hash_ten_cell(second, end_digest)?;
-    Ok(tip5::hash_ten_cell(first, tail)?)
-}
-
-fn hash_zset_hashes(set: Noun, arena: &Arena, ctx: &TxIdCtx) -> Result<[u64; 5], SignDraftError> {
-    if set == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-    let (value, left, right) = tuple3(set, arena).ok_or(SignDraftError::Malformed)?;
-    let value_digest = parse_hash(value, arena).ok_or(SignDraftError::Malformed)?;
-    let left_digest = hash_zset_hashes(left, arena, ctx)?;
-    let right_digest = hash_zset_hashes(right, arena, ctx)?;
-    let children_digest = tip5::hash_ten_cell(left_digest, right_digest)?;
-    Ok(tip5::hash_ten_cell(value_digest, children_digest)?)
-}
-
-fn hash_optional_leaf(opt: Noun, arena: &Arena, ctx: &TxIdCtx) -> Result<[u64; 5], SignDraftError> {
-    if opt == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-    let (tag, value) = tuple2(opt, arena).ok_or(SignDraftError::Malformed)?;
-    if tag != arena.atom0() {
-        return Err(SignDraftError::Malformed);
-    }
-    let value_digest = tip5::hash_noun_varlen(value, arena)?;
-    Ok(tip5::hash_ten_cell(ctx.null_digest, value_digest)?)
-}
-
-fn hash_timelock_range(
-    range: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], SignDraftError> {
-    let (min, max) = tuple2(range, arena).ok_or(SignDraftError::Malformed)?;
-    let min_digest = hash_optional_leaf(min, arena, ctx)?;
-    let max_digest = hash_optional_leaf(max, arena, ctx)?;
-    Ok(tip5::hash_ten_cell(min_digest, max_digest)?)
-}
-
-fn hash_lock_primitive_hashable(
-    lp: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], SignDraftError> {
-    let (header, body) = tuple2(lp, arena).ok_or(SignDraftError::Malformed)?;
-    let Noun::Atom(header_id) = header else {
-        return Err(SignDraftError::Malformed);
-    };
-
-    if arena.atom_eq_bytes(header_id, b"pkh") {
-        let (m, h) = tuple2(body, arena).ok_or(SignDraftError::Malformed)?;
-        let tag_digest = tip5::hash_noun_varlen(header, arena)?;
-        let m_digest = tip5::hash_noun_varlen(m, arena)?;
-        let h_digest = hash_zset_hashes(h, arena, ctx)?;
-        let inner = tip5::hash_ten_cell(m_digest, h_digest)?;
-        return Ok(tip5::hash_ten_cell(tag_digest, inner)?);
-    }
-
-    if arena.atom_eq_bytes(header_id, b"tim") {
-        let (rel, abs) = tuple2(body, arena).ok_or(SignDraftError::Malformed)?;
-        let tag_digest = tip5::hash_noun_varlen(header, arena)?;
-        let rel_digest = hash_timelock_range(rel, arena, ctx)?;
-        let abs_digest = hash_timelock_range(abs, arena, ctx)?;
-        let inner = tip5::hash_ten_cell(rel_digest, abs_digest)?;
-        return Ok(tip5::hash_ten_cell(tag_digest, inner)?);
-    }
-
-    if arena.atom_eq_bytes(header_id, b"hax") {
-        // `%hax` body is the z-set of preimage commitments and hashes exactly
-        // like `%pkh`'s hash set (nockchain `hashable:hax`). The old `"fake"`
-        // placeholder produced a wrong tx id for every HAX-locked spend.
-        let tag_digest = tip5::hash_noun_varlen(header, arena)?;
-        let h_digest = hash_zset_hashes(body, arena, ctx)?;
-        return Ok(tip5::hash_ten_cell(tag_digest, h_digest)?);
-    }
-
-    if arena.atom_eq_bytes(header_id, b"brn") {
-        let tag_digest = tip5::hash_noun_varlen(header, arena)?;
-        return Ok(tip5::hash_ten_cell(tag_digest, ctx.null_digest)?);
-    }
-
-    Err(SignDraftError::Unsupported)
+fn hash_lock_primitives_list(prims: Noun, arena: &Arena) -> Result<[u64; 5], SignDraftError> {
+    let condition =
+        tx_types::SpendCondition::decode(prims, arena).map_err(|_| SignDraftError::Malformed)?;
+    Ok(condition.to_hash().values)
 }
 
-fn hash_lock_primitives_list(
-    prims: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], SignDraftError> {
-    if prims == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-    let (head, tail) = uncons(prims, arena).ok_or(SignDraftError::Malformed)?;
-    let head_digest = hash_lock_primitive_hashable(head, arena, ctx)?;
-    let tail_digest = hash_lock_primitives_list(tail, arena, ctx)?;
-    Ok(tip5::hash_ten_cell(head_digest, tail_digest)?)
-}
-
-fn hash_merkle_proof_hashable(
-    merk: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], SignDraftError> {
-    let (root_noun, path) = tuple2(merk, arena).ok_or(SignDraftError::Malformed)?;
-    let root = parse_hash(root_noun, arena).ok_or(SignDraftError::Malformed)?;
-    let path_digest = hash_hash_list_hashes(path, arena, ctx)?;
-    Ok(tip5::hash_ten_cell(root, path_digest)?)
-}
-
-fn hash_hash_list_hashes(
-    list: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], SignDraftError> {
-    if list == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-    let (head, tail) = uncons(list, arena).ok_or(SignDraftError::Malformed)?;
-    let head_digest = parse_hash(head, arena).ok_or(SignDraftError::Malformed)?;
-    let tail_digest = hash_hash_list_hashes(tail, arena, ctx)?;
-    Ok(tip5::hash_ten_cell(head_digest, tail_digest)?)
-}
-
-fn hash_lock_merkle_proof_hashable(
-    lmp: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], SignDraftError> {
-    let (version, spend_condition, axis, merk_proof) = decompose_lock_merkle_proof(lmp, arena)?;
-    let spend_condition_hash = hash_lock_primitives_list(spend_condition, arena, ctx)?;
-    let merk_digest = hash_merkle_proof_hashable(merk_proof, arena, ctx)?;
-
-    match version {
-        Some(version) => {
-            let version_digest = tip5::hash_noun_varlen(version, arena)?;
-            let axis_digest = tip5::hash_noun_varlen(axis, arena)?;
-            let inner = tip5::hash_ten_cell(axis_digest, merk_digest)?;
-            let inner = tip5::hash_ten_cell(spend_condition_hash, inner)?;
-            Ok(tip5::hash_ten_cell(version_digest, inner)?)
-        }
-        None => {
-            let inner = tip5::hash_ten_cell(ctx.axis_digest, merk_digest)?;
-            Ok(tip5::hash_ten_cell(spend_condition_hash, inner)?)
-        }
-    }
-}
-
-fn hash_hax_map_hashable(
-    map: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], SignDraftError> {
-    if map == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-    let (node, left, right) = decompose_map(map, arena).ok_or(SignDraftError::Malformed)?;
-    let (key, value) = decompose_pair(node, arena).ok_or(SignDraftError::Malformed)?;
-
-    let key_digest = parse_hash(key, arena).ok_or(SignDraftError::Malformed)?;
-    let value_digest = hashable_noun_digest(value, arena)?;
-    let node_digest = tip5::hash_ten_cell(key_digest, value_digest)?;
-
-    let left_digest = hash_hax_map_hashable(left, arena, ctx)?;
-    let right_digest = hash_hax_map_hashable(right, arena, ctx)?;
-    let children_digest = tip5::hash_ten_cell(left_digest, right_digest)?;
-    Ok(tip5::hash_ten_cell(node_digest, children_digest)?)
-}
-
-fn hash_pkh_signature_value_hashable(
-    value: Noun,
-    arena: &Arena,
-) -> Result<[u64; 5], SignDraftError> {
-    let (pk, sig) = tuple2(value, arena).ok_or(SignDraftError::Malformed)?;
-    let pk_digest = tip5::hash_noun_varlen(pk, arena)?;
-    let sig_digest = tip5::hash_noun_varlen(sig, arena)?;
-    Ok(tip5::hash_ten_cell(pk_digest, sig_digest)?)
-}
-
-fn hash_pkh_signature_map_hashable(
-    map: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], SignDraftError> {
-    if map == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-    let (node, left, right) = decompose_map(map, arena).ok_or(SignDraftError::Malformed)?;
-    let (key, value) = decompose_pair(node, arena).ok_or(SignDraftError::Malformed)?;
-
-    let key_digest = parse_hash(key, arena).ok_or(SignDraftError::Malformed)?;
-    let value_digest = hash_pkh_signature_value_hashable(value, arena)?;
-    let node_digest = tip5::hash_ten_cell(key_digest, value_digest)?;
-
-    let left_digest = hash_pkh_signature_map_hashable(left, arena, ctx)?;
-    let right_digest = hash_pkh_signature_map_hashable(right, arena, ctx)?;
-    let children_digest = tip5::hash_ten_cell(left_digest, right_digest)?;
-    Ok(tip5::hash_ten_cell(node_digest, children_digest)?)
-}
-
-fn hash_seed_regular_hashable(seed: Noun, arena: &Arena) -> Result<[u64; 5], SignDraftError> {
-    let (_output_source, lock_root_noun, note_data_noun, gift_noun, parent_hash_noun) =
-        tuple5(seed, arena).ok_or(SignDraftError::Malformed)?;
-
-    let lock_root = parse_hash(lock_root_noun, arena).ok_or(SignDraftError::Malformed)?;
-    let note_data_hash = hash_note_data(note_data_noun, arena)?;
-    let gift_digest = tip5::hash_noun_varlen(gift_noun, arena)?;
-    let parent_hash = parse_hash(parent_hash_noun, arena).ok_or(SignDraftError::Malformed)?;
-
-    let mut acc = parent_hash;
-    acc = tip5::hash_ten_cell(gift_digest, acc)?;
-    acc = tip5::hash_ten_cell(note_data_hash, acc)?;
-    acc = tip5::hash_ten_cell(lock_root, acc)?;
-    Ok(acc)
-}
-
-fn hash_seeds_regular(
-    seeds_zset: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], SignDraftError> {
-    if seeds_zset == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-
-    let (seed, lr) = uncons(seeds_zset, arena).ok_or(SignDraftError::Malformed)?;
-    let (left, right) = uncons(lr, arena).ok_or(SignDraftError::Malformed)?;
-
-    let node_digest = hash_seed_regular_hashable(seed, arena)?;
-    let left_digest = hash_seeds_regular(left, arena, ctx)?;
-    let right_digest = hash_seeds_regular(right, arena, ctx)?;
-    let children_digest = tip5::hash_ten_cell(left_digest, right_digest)?;
-    Ok(tip5::hash_ten_cell(node_digest, children_digest)?)
-}
-
-fn hash_witness_hashable(
-    witness: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], SignDraftError> {
-    let (lmp, pkh_map, hax, _tim) = tuple4(witness, arena).ok_or(SignDraftError::Malformed)?;
-
-    let lmp_hash = hash_lock_merkle_proof_hashable(lmp, arena, ctx)?;
-    let pkh_hash = hash_pkh_signature_map_hashable(pkh_map, arena, ctx)?;
-    let hax_hash = hash_hax_map_hashable(hax, arena, ctx)?;
-    // Upstream decodes `Witness` with `tim = 0` (the field is a placeholder;
-    // Hoon requires `~`), so any spelling hashes as leaf+0 and is normalized
-    // away when the signed draft is re-jammed.
-    let tim_digest = ctx.null_digest;
-
-    let mut acc = tim_digest;
-    acc = tip5::hash_ten_cell(hax_hash, acc)?;
-    acc = tip5::hash_ten_cell(pkh_hash, acc)?;
-    acc = tip5::hash_ten_cell(lmp_hash, acc)?;
-    Ok(acc)
-}
-
-fn hash_spend_v1_hashable(
-    spend: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], SignDraftError> {
-    let (ver_noun, body_noun) = tuple2(spend, arena).ok_or(SignDraftError::Malformed)?;
-    if noun_atom_u64(ver_noun, arena) != Some(1) {
-        return Err(SignDraftError::Unsupported);
-    }
-
-    let (witness, seeds, fee) = tuple3(body_noun, arena).ok_or(SignDraftError::Malformed)?;
-    let witness_digest = hash_witness_hashable(witness, arena, ctx)?;
-    let seeds_digest = hash_seeds_regular(seeds, arena, ctx)?;
-    let fee_digest = tip5::hash_noun_varlen(fee, arena)?;
-
-    let inner = tip5::hash_ten_cell(seeds_digest, fee_digest)?;
-    let body_digest = tip5::hash_ten_cell(witness_digest, inner)?;
-    let ver_digest = tip5::hash_noun_varlen(ver_noun, arena)?;
-    Ok(tip5::hash_ten_cell(ver_digest, body_digest)?)
-}
-
-fn hash_spends_hashable(
-    spends: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], SignDraftError> {
-    if spends == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-
-    let (node, left, right) = decompose_map(spends, arena).ok_or(SignDraftError::Malformed)?;
-    let (name_noun, spend_noun) = decompose_pair(node, arena).ok_or(SignDraftError::Malformed)?;
-
-    let name_digest = hash_nname_hashable(name_noun, arena)?;
-    let spend_digest = hash_spend_v1_hashable(spend_noun, arena, ctx)?;
-    let node_digest = tip5::hash_ten_cell(name_digest, spend_digest)?;
-
-    let left_digest = hash_spends_hashable(left, arena, ctx)?;
-    let right_digest = hash_spends_hashable(right, arena, ctx)?;
-    let children_digest = tip5::hash_ten_cell(left_digest, right_digest)?;
-    Ok(tip5::hash_ten_cell(node_digest, children_digest)?)
-}
-
-fn compute_tx_id_v1(
-    spends: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], SignDraftError> {
-    let spends_digest = hash_spends_hashable(spends, arena, ctx)?;
-    Ok(tip5::hash_ten_cell(ctx.version_digest, spends_digest)?)
+fn compute_tx_id_v1(spends: Noun, arena: &Arena) -> Result<[u64; 5], SignDraftError> {
+    let spends =
+        tx_types::SpendsV1::decode(spends, arena).map_err(|_| SignDraftError::Malformed)?;
+    tx_types::compute_tx_id_v1(&spends)
+        .map(|hash| hash.values)
+        .map_err(|_| SignDraftError::Malformed)
 }
 
 fn looks_like_spends_v1_map(spends: Noun, arena: &Arena) -> bool {
@@ -1759,7 +1193,6 @@ fn parse_lock_summary(
     note_data: Noun,
     lock_root: [u64; 5],
     arena: &Arena,
-    ctx: &TxIdCtx,
 ) -> Result<Option<LockSummaryV1>, SignDraftError> {
     let Some(lock_data) = note_data_find(note_data, arena, b"lock") else {
         return Ok(None);
@@ -1788,7 +1221,7 @@ fn parse_lock_summary(
         return Ok(None);
     }
 
-    let computed = hash_lock_primitives_list(sc, arena, ctx)?;
+    let computed = hash_lock_primitives_list(sc, arena)?;
     Ok(Some(LockSummaryV1 {
         verified: computed == lock_root,
         primitives,
@@ -1912,7 +1345,6 @@ fn collect_outputs_from_seeds(
     seeds_zset: Noun,
     arena: &Arena,
     signer_pkh: [u64; 5],
-    ctx: &TxIdCtx,
     acc: &mut Vec<OutAcc>,
     refund: &mut Option<RefundAcc>,
 ) -> Result<(), SignDraftError> {
@@ -1932,7 +1364,7 @@ fn collect_outputs_from_seeds(
     if gift != 0 {
         let lock_root_digest =
             parse_hash(lock_root_noun, arena).ok_or(SignDraftError::Malformed)?;
-        let lock = parse_lock_summary(note_data, lock_root_digest, arena, ctx)?;
+        let lock = parse_lock_summary(note_data, lock_root_digest, arena)?;
         // A note-data "pkh" is display metadata unless the supplied lock
         // primitives hash to the committed lock root. Fall back to the root
         // itself for missing, unknown, malformed, or mismatched locks so a
@@ -1993,8 +1425,8 @@ fn collect_outputs_from_seeds(
         }
     }
 
-    collect_outputs_from_seeds(left, arena, signer_pkh, ctx, acc, refund)?;
-    collect_outputs_from_seeds(right, arena, signer_pkh, ctx, acc, refund)?;
+    collect_outputs_from_seeds(left, arena, signer_pkh, acc, refund)?;
+    collect_outputs_from_seeds(right, arena, signer_pkh, acc, refund)?;
     Ok(())
 }
 
@@ -2003,7 +1435,6 @@ fn collect_outputs_from_spends(
     spends: Noun,
     arena: &Arena,
     signer_pkh: [u64; 5],
-    ctx: &TxIdCtx,
     acc: &mut Vec<OutAcc>,
     refund: &mut Option<RefundAcc>,
     input_count: &mut u32,
@@ -2027,23 +1458,13 @@ fn collect_outputs_from_spends(
     *fee_total = fee_total
         .checked_add(fee)
         .ok_or(SignDraftError::Malformed)?;
-    collect_outputs_from_seeds(seeds, arena, signer_pkh, ctx, acc, refund)?;
+    collect_outputs_from_seeds(seeds, arena, signer_pkh, acc, refund)?;
 
-    collect_outputs_from_spends(
-        left,
-        arena,
-        signer_pkh,
-        ctx,
-        acc,
-        refund,
-        input_count,
-        fee_total,
-    )?;
+    collect_outputs_from_spends(left, arena, signer_pkh, acc, refund, input_count, fee_total)?;
     collect_outputs_from_spends(
         right,
         arena,
         signer_pkh,
-        ctx,
         acc,
         refund,
         input_count,
@@ -2112,12 +1533,7 @@ pub fn draft_review_v1_for_pkh(
     draft_jam: &[u8],
     signer_pkh: [u64; 5],
 ) -> Result<DraftReviewV1, SignDraftError> {
-    draft_review_v1_for_pkh_with_policy(
-        draft_jam,
-        signer_pkh,
-        BYTHOS_PHASE,
-        FeePolicy::default(),
-    )
+    draft_review_v1_for_pkh_with_policy(draft_jam, signer_pkh, BYTHOS_PHASE, FeePolicy::default())
 }
 
 pub fn draft_review_v1_for_pkh_with_policy(
@@ -2168,19 +1584,16 @@ pub fn draft_review_v1_for_pkh_with_policy(
         return Err(SignDraftError::Malformed);
     };
 
-    let minimum_fee =
-        calculate_minimum_fee_v1(&mut arena, spends, current_height, &fee_policy)?;
+    let minimum_fee = calculate_minimum_fee_v1(&mut arena, spends, current_height, &fee_policy)?;
 
     let mut acc: Vec<OutAcc> = Vec::new();
     let mut refund: Option<RefundAcc> = None;
     let mut input_count = 0u32;
     let mut fee_total = 0u64;
-    let ctx = tx_id_ctx(&mut arena)?;
     collect_outputs_from_spends(
         spends,
         &arena,
         signer_pkh,
-        &ctx,
         &mut acc,
         &mut refund,
         &mut input_count,
@@ -2275,8 +1688,6 @@ pub fn sign_draft_v1_with_policy(
     let pk_tuple = [x_noun, y_noun, inf_noun];
     let pk_noun = build_tuple(&mut arena, &pk_tuple);
 
-    let txid_ctx = tx_id_ctx(&mut arena)?;
-
     // pkh = hash-noun-varlen(pubkey noun)
     let pkh_digest = tip5::hash_noun_varlen(pk_noun, &arena)?;
     let pkh_key_noun = build_hash_noun(&mut arena, pkh_digest);
@@ -2369,7 +1780,7 @@ pub fn sign_draft_v1_with_policy(
                 cfg,
                 pk_coords,
             )?;
-            let tx_id = compute_tx_id_v1(new_spends, &arena, &txid_ctx)?;
+            let tx_id = compute_tx_id_v1(new_spends, &arena)?;
             let name_b58 = digest_to_b58(tx_id);
             let name_noun = arena.alloc_atom_bytes(name_b58.as_bytes());
             build_tuple(&mut arena, &[name_noun, new_spends])
@@ -2389,7 +1800,7 @@ pub fn sign_draft_v1_with_policy(
                 cfg,
                 pk_coords,
             )?;
-            let tx_id = compute_tx_id_v1(new_spends, &arena, &txid_ctx)?;
+            let tx_id = compute_tx_id_v1(new_spends, &arena)?;
             let name_b58 = digest_to_b58(tx_id);
             let name_noun = arena.alloc_atom_bytes(name_b58.as_bytes());
             build_tuple(
@@ -2408,7 +1819,7 @@ pub fn sign_draft_v1_with_policy(
                 cfg,
                 pk_coords,
             )?;
-            let tx_id = compute_tx_id_v1(new_spends, &arena, &txid_ctx)?;
+            let tx_id = compute_tx_id_v1(new_spends, &arena)?;
             let id_noun = build_hash_noun(&mut arena, tx_id);
             build_tuple(&mut arena, &[ver, id_noun, new_spends])
         }
@@ -2423,7 +1834,7 @@ pub fn sign_draft_v1_with_policy(
                 cfg,
                 pk_coords,
             )?;
-            let tx_id = compute_tx_id_v1(new_spends, &arena, &txid_ctx)?;
+            let tx_id = compute_tx_id_v1(new_spends, &arena)?;
             let id_noun = build_hash_noun(&mut arena, tx_id);
             let new_raw = build_tuple(&mut arena, &[ver, id_noun, new_spends]);
             arena.alloc_cell(new_raw, tail)
@@ -2436,7 +1847,6 @@ pub fn sign_draft_v1_with_policy(
 pub fn rewrite_txid_v1(tx_jam: &[u8]) -> Result<RewriteTxIdV1, SignDraftError> {
     let mut arena = Arena::new();
     let root = cue(tx_jam, &mut arena)?;
-    let txid_ctx = tx_id_ctx(&mut arena)?;
 
     let rewrite = |arena: &mut Arena, name: String, new_root: Noun| -> RewriteTxIdV1 {
         RewriteTxIdV1 {
@@ -2447,7 +1857,7 @@ pub fn rewrite_txid_v1(tx_jam: &[u8]) -> Result<RewriteTxIdV1, SignDraftError> {
 
     if let Some((ver, id, spends)) = tuple3(root, &arena) {
         if noun_atom_u64(ver, &arena) == Some(1) && parse_hash(id, &arena).is_some() {
-            let tx_id = compute_tx_id_v1(spends, &arena, &txid_ctx)?;
+            let tx_id = compute_tx_id_v1(spends, &arena)?;
             let name = digest_to_b58(tx_id);
             if parse_hash(id, &arena) == Some(tx_id) {
                 return Ok(RewriteTxIdV1 {
@@ -2469,7 +1879,7 @@ pub fn rewrite_txid_v1(tx_jam: &[u8]) -> Result<RewriteTxIdV1, SignDraftError> {
         if noun_atom_u64(ver, &arena) != Some(1) || parse_hash(id, &arena).is_none() {
             return Err(SignDraftError::Unsupported);
         }
-        let tx_id = compute_tx_id_v1(spends, &arena, &txid_ctx)?;
+        let tx_id = compute_tx_id_v1(spends, &arena)?;
         let name = digest_to_b58(tx_id);
         if parse_hash(id, &arena) == Some(tx_id) {
             return Ok(RewriteTxIdV1 {
@@ -2493,7 +1903,7 @@ pub fn rewrite_txid_v1(tx_jam: &[u8]) -> Result<RewriteTxIdV1, SignDraftError> {
         if !looks_like_spends_v1_map(spends, &arena) {
             return Err(SignDraftError::Malformed);
         }
-        let tx_id = compute_tx_id_v1(spends, &arena, &txid_ctx)?;
+        let tx_id = compute_tx_id_v1(spends, &arena)?;
         let name = digest_to_b58(tx_id);
         if atom_eq_bytes(name_noun, name.as_bytes(), &arena) {
             return Ok(RewriteTxIdV1 {
@@ -2512,7 +1922,7 @@ pub fn rewrite_txid_v1(tx_jam: &[u8]) -> Result<RewriteTxIdV1, SignDraftError> {
     if !looks_like_spends_v1_map(tail, &arena) {
         return Err(SignDraftError::Malformed);
     }
-    let tx_id = compute_tx_id_v1(tail, &arena, &txid_ctx)?;
+    let tx_id = compute_tx_id_v1(tail, &arena)?;
     let name = digest_to_b58(tx_id);
     if atom_eq_bytes(head, name.as_bytes(), &arena) {
         return Ok(RewriteTxIdV1 {
diff --git a/nockster-esp/crates/nockster-core/tests/draft_sign_v1.rs b/nockster-esp/crates/nockster-core/tests/draft_sign_v1.rs
index 285b41d..b3c50c1 100644
--- a/nockster-esp/crates/nockster-core/tests/draft_sign_v1.rs
+++ b/nockster-esp/crates/nockster-core/tests/draft_sign_v1.rs
@@ -46,13 +46,10 @@ fn empty_full_lock_merkle_proof(spend_condition: SpendCondition) -> LockMerklePr
 }
 
 fn note_data_for_lock(spend_condition: &SpendCondition) -> NoteData {
-    let lock_data = tx_types::tx_builder_v1::LockData::V0(spend_condition.clone());
-    let mut map = ZMap::new();
-    map.put(
-        "lock".to_string(),
-        tx_types::tx_builder_v1::lock_data_to_untyped_noun(&lock_data),
-    );
-    NoteData { map }
+    NoteData::from_lock(tx_types::lock::Lock::SpendCondition(
+        spend_condition.clone(),
+    ))
+    .unwrap()
 }
 
 fn runtime_signer_scalar() -> [u8; 32] {
@@ -158,8 +155,9 @@ fn sign_draft_v1_inserts_expected_signature() {
     let noun2 = slab2
         .cue_into(Bytes::from(signed_jam))
         .expect("cue signed jam");
-    let signed_raw = tx_types::transaction_types_v1::RawTransactionV1::from_noun(&noun2, &slab2.noun_space())
-        .expect("decode v1 raw-tx");
+    let signed_raw =
+        tx_types::transaction_types_v1::RawTransactionV1::from_noun(&noun2, &slab2.noun_space())
+            .expect("decode v1 raw-tx");
 
     let computed_id = compute_tx_id_v1(&signed_raw.spends).expect("tx id");
     assert_eq!(signed_raw.id, computed_id, "tx-id should be recomputed");
@@ -311,8 +309,9 @@ fn sign_draft_v1_handles_seeds_and_note_data() {
     let noun2 = slab2
         .cue_into(Bytes::from(signed_jam))
         .expect("cue signed jam");
-    let signed_raw = tx_types::transaction_types_v1::RawTransactionV1::from_noun(&noun2, &slab2.noun_space())
-        .expect("decode v1 raw-tx");
+    let signed_raw =
+        tx_types::transaction_types_v1::RawTransactionV1::from_noun(&noun2, &slab2.noun_space())
+            .expect("decode v1 raw-tx");
 
     let computed_id = compute_tx_id_v1(&signed_raw.spends).expect("tx id");
     assert_eq!(signed_raw.id, computed_id, "tx-id should be recomputed");
@@ -608,8 +607,11 @@ fn sign_draft_v1_preserves_tx_transact_tail() {
     let tail_jam_after = jam_single(cell2.tail());
     assert_eq!(tail_jam_after, tail_jam_before, "tx:transact tail changed");
 
-    let signed_raw = tx_types::transaction_types_v1::RawTransactionV1::from_noun(&cell2.head(), &slab2.noun_space())
-        .expect("decode head raw-tx");
+    let signed_raw = tx_types::transaction_types_v1::RawTransactionV1::from_noun(
+        &cell2.head(),
+        &slab2.noun_space(),
+    )
+    .expect("decode head raw-tx");
 
     let computed_id = compute_tx_id_v1(&signed_raw.spends).expect("tx id");
     assert_eq!(signed_raw.id, computed_id, "tx-id should be recomputed");
@@ -721,7 +723,8 @@ fn sign_draft_v1_wallet_wrapper_updates_name() {
         .cue_into(Bytes::from(rewritten_jam.clone()))
         .expect("cue rewritten wallet");
     let rewritten_wallet =
-        WalletTransactionV1::from_noun(&rewrite_noun, &rewrite_slab.noun_space()).expect("decode rewritten wallet");
+        WalletTransactionV1::from_noun(&rewrite_noun, &rewrite_slab.noun_space())
+            .expect("decode rewritten wallet");
     assert_eq!(rewritten_wallet.name, expected_id.to_b58());
 
     let stable = nockster_core::draft_sign::rewrite_txid_v1(&rewritten_jam)
@@ -750,7 +753,8 @@ fn sign_draft_v1_wallet_wrapper_updates_name() {
     let noun2 = slab2
         .cue_into(Bytes::from(signed_jam))
         .expect("cue signed jam");
-    let signed_wallet = WalletTransactionV1::from_noun(&noun2, &slab2.noun_space()).expect("decode wallet v1");
+    let signed_wallet =
+        WalletTransactionV1::from_noun(&noun2, &slab2.noun_space()).expect("decode wallet v1");
 
     let computed_id = compute_tx_id_v1(&signed_wallet.spends).expect("tx id");
     let parsed_id = Hash::from_b58(&signed_wallet.name).expect("wallet name decodes as hash");
@@ -966,8 +970,9 @@ fn sign_draft_v1_replaces_placeholder_when_map_full() {
     let noun2 = slab2
         .cue_into(Bytes::from(signed_jam))
         .expect("cue signed jam");
-    let signed_raw = tx_types::transaction_types_v1::RawTransactionV1::from_noun(&noun2, &slab2.noun_space())
-        .expect("decode v1 raw-tx");
+    let signed_raw =
+        tx_types::transaction_types_v1::RawTransactionV1::from_noun(&noun2, &slab2.noun_space())
+            .expect("decode v1 raw-tx");
 
     let computed_id = compute_tx_id_v1(&signed_raw.spends).expect("tx id");
     assert_eq!(signed_raw.id, computed_id, "tx-id should be recomputed");
@@ -1050,7 +1055,9 @@ fn simple_pkh_draft(pkh: &Hash, fee: u64, tim: u64) -> (Vec<u8>, NName) {
 
 fn decode_signed(jam: &[u8]) -> RawTransactionV1 {
     let mut slab: NounSlab = NounSlab::new();
-    let noun = slab.cue_into(Bytes::from(jam.to_vec())).expect("cue signed");
+    let noun = slab
+        .cue_into(Bytes::from(jam.to_vec()))
+        .expect("cue signed");
     RawTransactionV1::from_noun(&noun, &slab.noun_space()).expect("decode signed")
 }
 
@@ -1131,9 +1138,9 @@ fn fee_policy_tracks_bythos_and_overrides() {
     let cfg = nockster_core::draft_sign::SignerConfig { sk_be };
     let default = FeePolicy::default();
 
-    let post =
-        draft_review_v1_with_policy(&draft_jam, &cfg, BYTHOS_PHASE, default).expect("post");
-    let pre = draft_review_v1_with_policy(&draft_jam, &cfg, BYTHOS_PHASE - 1, default).expect("pre");
+    let post = draft_review_v1_with_policy(&draft_jam, &cfg, BYTHOS_PHASE, default).expect("post");
+    let pre =
+        draft_review_v1_with_policy(&draft_jam, &cfg, BYTHOS_PHASE - 1, default).expect("pre");
     assert!(
         pre.minimum_fee > post.minimum_fee,
         "pre-Bythos fees use 2x base and no witness discount"
@@ -1212,7 +1219,7 @@ fn sign_draft_v1_rejects_fee_below_minimum() {
 }
 
 #[test]
-fn sign_draft_v1_normalizes_nonzero_tim() {
+fn sign_draft_v1_rejects_nonzero_tim() {
     let sk_be = runtime_signer_scalar();
     let pk_arr = nockster_core::cheetah_pub_from_sk(sk_be);
     let pkh = SchnorrPubkey {
@@ -1221,19 +1228,40 @@ fn sign_draft_v1_normalizes_nonzero_tim() {
         inf: false,
     }
     .to_hash();
-    let (draft_jam, name) = simple_pkh_draft(&pkh, 10_000_000, 5);
-    let signed = nockster_core::draft_sign::sign_draft_v1(
+    let (draft_jam, _) = simple_pkh_draft(&pkh, 10_000_000, 0);
+    let mut arena = pokenoun::Arena::new();
+    let noun = pokenoun::cue(&draft_jam, &mut arena).unwrap();
+    // [version id spends], with one [name [version witness seeds fee]] entry.
+    fn replace(noun: pokenoun::Noun, path: &[bool], arena: &mut pokenoun::Arena) -> pokenoun::Noun {
+        if path.is_empty() {
+            return arena.alloc_atom_u64(5);
+        }
+        let pokenoun::Noun::Cell(id) = noun else {
+            panic!("expected cell")
+        };
+        let cell = *arena.cell(id);
+        let child = replace(
+            if path[0] { cell.tail } else { cell.head },
+            &path[1..],
+            arena,
+        );
+        if path[0] {
+            arena.alloc_cell(cell.head, child)
+        } else {
+            arena.alloc_cell(child, cell.tail)
+        }
+    }
+    let malformed = replace(
+        noun,
+        &[true, true, false, true, true, false, true, true, true],
+        &mut arena,
+    );
+    let draft_jam = pokenoun::jam(malformed, &arena);
+    assert!(nockster_core::draft_sign::sign_draft_v1(
         &draft_jam,
         &nockster_core::draft_sign::SignerConfig { sk_be },
     )
-    .expect("sign nonzero-tim draft");
-    let signed_raw = decode_signed(&signed);
-    let spend = signed_raw.spends.map.get(&name).expect("spend");
-    let SpendBody::V1(sv1) = &spend.body else {
-        panic!("expected v1 spend");
-    };
-    assert_eq!(sv1.witness.tim, 0, "tim must be normalized like upstream");
-    assert_eq!(signed_raw.id, compute_tx_id_v1(&signed_raw.spends).expect("tx id"));
+    .is_err());
 }
 
 fn poke_tuple(arena: &mut pokenoun::Arena, elems: &[pokenoun::Noun]) -> pokenoun::Noun {
diff --git a/nockster-esp/crates/nockster-fw/Cargo.toml b/nockster-esp/crates/nockster-fw/Cargo.toml
index 95b4a3c..a1e1b5d 100644
--- a/nockster-esp/crates/nockster-fw/Cargo.toml
+++ b/nockster-esp/crates/nockster-fw/Cargo.toml
@@ -3,7 +3,7 @@ name         = "nockster-fw"
 authors      = ["Southwestern Pool Supply Co", "SWPSCo <howdy@swps.io>"]
 edition      = "2021"
 rust-version = "1.86"
-version      = "0.3.0"
+version      = "0.4.0"
 build        = "build.rs"
 
 [[bin]]
diff --git a/nockster-esp/crates/nockster-wasm/src/compose_v1.rs b/nockster-esp/crates/nockster-wasm/src/compose_v1.rs
index bd5e4f3..452cdbc 100644
--- a/nockster-esp/crates/nockster-wasm/src/compose_v1.rs
+++ b/nockster-esp/crates/nockster-wasm/src/compose_v1.rs
@@ -1,23 +1,26 @@
+//! Browser DTOs and wallet-envelope serialization around the shared planner.
 use serde::{Deserialize, Serialize};
-use wasm_bindgen::prelude::*;
-
-use nockster_core::draft_sign::{digest_from_b58, FeePolicy, LOCK_MERKLE_AXIS_HASH_B58};
-#[cfg(test)]
-use nockster_core::draft_sign::BYTHOS_PHASE;
-use tx_types::pokenoun::{
-    canonical_zmap_put, canonical_zset_put, cue, hash_noun_varlen, hash_ten_cell, jam, Arena, Noun,
+use tx_types::lock::Lock;
+use tx_types::lock_resolver::{LockMatcher, LockResolution, SigningKeyLockMatcher};
+use tx_types::planner::{self, ChainContext, PlanRequest, PlannedOutput, SelectionOrder};
+use tx_types::pokenoun::codec::{tuple, Decode, Encode, Error, Fields};
+use tx_types::pokenoun::{Arena, Noun};
+use tx_types::{
+    Brn, Coins, Hash, Hax, LockPrimitive, LockPrimitiveBody, NName, NNote, NNoteV1, NoteData,
+    PageNumber, Pkh, RawTransactionV1, SpendBody, SpendCondition, SpendsV1, Tim, TimelockRange,
+    UntypedNoun, Witness, ZMap, ZSet,
 };
+use wasm_bindgen::prelude::*;
 
-const DEFAULT_COINBASE_REL_MIN: u64 = 100;
-const LOCK_MERKLE_PROOF_FULL_TAG: &[u8] = b"full";
-
-fn js_err(msg: impl AsRef<str>) -> JsValue {
-    JsValue::from_str(msg.as_ref())
+fn js_err(error: impl core::fmt::Display) -> JsValue {
+    JsValue::from_str(&error.to_string())
 }
 
 #[derive(Debug, Clone, Deserialize)]
 pub struct ComposeTxV1Input {
     pub source_pkh: String,
+    #[serde(default)]
+    pub manual_inputs: bool,
     pub notes: Vec<NoteInput>,
     pub outputs: Vec<OutputInput>,
     #[serde(default)]
@@ -55,10 +58,14 @@ pub struct MultisigSourceInput {
 pub struct OrSourceInput {
     pub branches: Vec<LockBranch>,
     pub spend_branch: u64,
+    #[serde(default)]
+    pub preimages: Vec<Vec<u8>>,
 }
 
 #[derive(Debug, Clone, Deserialize)]
 pub struct NoteInput {
+    /// Actual RPC note data; an empty object represents an empty on-chain map.
+    pub note_data: serde_json::Value,
     pub name_first: String,
     pub name_last: String,
     pub origin_page: u64,
@@ -162,3312 +169,624 @@ impl ComposedTransactionV1 {
     }
 }
 
-#[derive(Debug, Clone, Copy)]
-struct TxIdCtx {
-    null_digest: [u64; 5],
-    version_digest: [u64; 5],
-}
-
-fn tx_id_ctx(arena: &mut Arena) -> Result<TxIdCtx, JsValue> {
-    let null_digest =
-        hash_noun_varlen(arena.atom0(), arena).map_err(|e| js_err(format!("{e:?}")))?;
-    let version_atom = arena.alloc_atom_u64(1);
-    let version_digest =
-        hash_noun_varlen(version_atom, arena).map_err(|e| js_err(format!("{e:?}")))?;
-    Ok(TxIdCtx {
-        null_digest,
-        version_digest,
-    })
-}
-
-fn uncons(noun: Noun, arena: &Arena) -> Option<(Noun, Noun)> {
-    match noun {
-        Noun::Cell(id) => {
-            let cell = arena.cell(id);
-            Some((cell.head, cell.tail))
-        }
-        _ => None,
-    }
-}
-
-fn tuple2(noun: Noun, arena: &Arena) -> Option<(Noun, Noun)> {
-    uncons(noun, arena)
-}
-
-fn tuple3(noun: Noun, arena: &Arena) -> Option<(Noun, Noun, Noun)> {
-    let (a, bc) = uncons(noun, arena)?;
-    let (b, c) = uncons(bc, arena)?;
-    Some((a, b, c))
-}
-
-fn tuple4(noun: Noun, arena: &Arena) -> Option<(Noun, Noun, Noun, Noun)> {
-    let (a, bcd) = uncons(noun, arena)?;
-    let (b, cd) = uncons(bcd, arena)?;
-    let (c, d) = uncons(cd, arena)?;
-    Some((a, b, c, d))
-}
-
-fn tuple5(noun: Noun, arena: &Arena) -> Option<(Noun, Noun, Noun, Noun, Noun)> {
-    let (a, bcde) = uncons(noun, arena)?;
-    let (b, cde) = uncons(bcde, arena)?;
-    let (c, de) = uncons(cde, arena)?;
-    let (d, e) = uncons(de, arena)?;
-    Some((a, b, c, d, e))
-}
-
-fn noun_atom_u64(noun: Noun, arena: &Arena) -> Option<u64> {
-    match noun {
-        Noun::Atom(id) => arena.atom_u64(id),
-        _ => None,
-    }
-}
-
-fn build_tuple(arena: &mut Arena, elems: &[Noun]) -> Noun {
-    if elems.is_empty() {
-        return arena.atom0();
-    }
-    let mut res = *elems.last().unwrap();
-    for &n in elems[..elems.len() - 1].iter().rev() {
-        res = arena.alloc_cell(n, res);
-    }
-    res
-}
-
-fn build_list(arena: &mut Arena, elems: &[Noun]) -> Noun {
-    let mut out = arena.atom0();
-    for &elem in elems.iter().rev() {
-        out = arena.alloc_cell(elem, out);
-    }
-    out
-}
-
-fn build_hash_noun(arena: &mut Arena, digest: [u64; 5]) -> Noun {
-    let elems = [
-        arena.alloc_atom_u64(digest[0]),
-        arena.alloc_atom_u64(digest[1]),
-        arena.alloc_atom_u64(digest[2]),
-        arena.alloc_atom_u64(digest[3]),
-        arena.alloc_atom_u64(digest[4]),
-    ];
-    build_tuple(arena, &elems)
+fn hash(text: &str) -> Result<Hash, String> {
+    Hash::from_b58(text)
 }
 
-fn decompose_lock_merkle_proof(
-    lmp: Noun,
-    arena: &Arena,
-) -> Result<(Option<Noun>, Noun, Noun, Noun), JsValue> {
-    let (head, tail) = uncons(lmp, arena).ok_or_else(|| js_err("malformed lock merkle proof"))?;
-
-    let is_full = match head {
-        Noun::Atom(atom) => arena.atom_eq_bytes(atom, LOCK_MERKLE_PROOF_FULL_TAG),
-        _ => false,
+fn recipient_condition(recipient: &RecipientInput) -> Result<SpendCondition, String> {
+    let (m, hashes) = match recipient {
+        RecipientInput::Pkh(text) => (1, vec![hash(text)?]),
+        RecipientInput::Multisig { m, pkhs } => (
+            *m,
+            pkhs.iter()
+                .map(|text| hash(text))
+                .collect::<Result<_, _>>()?,
+        ),
     };
-
-    if is_full {
-        let (spend_condition, axis, merkle_proof) =
-            tuple3(tail, arena).ok_or_else(|| js_err("malformed lock merkle proof"))?;
-        return Ok((Some(head), spend_condition, axis, merkle_proof));
-    }
-
-    let (axis, merkle_proof) =
-        tuple2(tail, arena).ok_or_else(|| js_err("malformed lock merkle proof"))?;
-    Ok((None, head, axis, merkle_proof))
-}
-
-fn parse_hash(noun: Noun, arena: &Arena) -> Option<[u64; 5]> {
-    let (a0, rest) = uncons(noun, arena)?;
-    let (a1, rest) = uncons(rest, arena)?;
-    let (a2, rest) = uncons(rest, arena)?;
-    let (a3, a4) = uncons(rest, arena)?;
-    Some([
-        noun_atom_u64(a0, arena)?,
-        noun_atom_u64(a1, arena)?,
-        noun_atom_u64(a2, arena)?,
-        noun_atom_u64(a3, arena)?,
-        noun_atom_u64(a4, arena)?,
-    ])
+    let h = ZSet::gas(hashes);
+    if m == 0 || m > h.wyt() as u64 {
+        return Err("invalid multisig threshold".into());
+    }
+    Ok(SpendCondition {
+        p: vec![LockPrimitive {
+            header: "pkh".into(),
+            body: LockPrimitiveBody::Pkh(Pkh { m, h }),
+        }],
+    })
 }
 
-fn decompose_map(map: Noun, arena: &Arena) -> Option<(Noun, Noun, Noun)> {
-    let (node, tail) = uncons(map, arena)?;
-    if let Some((left, right)) = uncons(tail, arena) {
-        Some((node, left, right))
-    } else {
-        Some((node, tail, arena.atom0()))
+fn condition(branch: &LockBranch) -> Result<SpendCondition, String> {
+    if branch.burn {
+        return Ok(SpendCondition {
+            p: vec![LockPrimitive {
+                header: "brn".into(),
+                body: LockPrimitiveBody::Brn(Brn { value: 0 }),
+            }],
+        });
     }
-}
-
-fn decompose_pair(pair: Noun, arena: &Arena) -> Option<(Noun, Noun)> {
-    uncons(pair, arena)
-}
-
-fn nouns_equal(a: Noun, b: Noun, arena: &Arena) -> bool {
-    match (a, b) {
-        (Noun::Atom(x), Noun::Atom(y)) => arena.atom_bytes(x) == arena.atom_bytes(y),
-        (Noun::Cell(ac), Noun::Cell(bc)) => {
-            let a_cell = arena.cell(ac);
-            let b_cell = arena.cell(bc);
-            nouns_equal(a_cell.head, b_cell.head, arena)
-                && nouns_equal(a_cell.tail, b_cell.tail, arena)
+    let mut result = recipient_condition(
+        branch
+            .recipient
+            .as_ref()
+            .ok_or("condition needs a recipient or burn")?,
+    )?;
+    if let Some(tim) = &branch.timelock {
+        if [tim.rel_min, tim.rel_max, tim.abs_min, tim.abs_max]
+            .iter()
+            .all(Option::is_none)
+        {
+            return Err("timelock requires at least one bound".into());
         }
-        _ => false,
+        let range = |min: Option<u64>, max: Option<u64>| TimelockRange {
+            min: min.map(|value| PageNumber { value }),
+            max: max.map(|value| PageNumber { value }),
+        };
+        result.p.push(LockPrimitive {
+            header: "tim".into(),
+            body: LockPrimitiveBody::Tim(Tim {
+                rel: range(tim.rel_min, tim.rel_max),
+                abs: range(tim.abs_min, tim.abs_max),
+            }),
+        });
     }
-}
-
-fn hashable_noun_digest(noun: Noun, arena: &Arena) -> Result<[u64; 5], JsValue> {
-    match noun {
-        Noun::Atom(_) => Ok(hash_noun_varlen(noun, arena).map_err(|e| js_err(format!("{e:?}")))?),
-        Noun::Cell(id) => {
-            let cell = arena.cell(id);
-            let lh = hashable_noun_digest(cell.head, arena)?;
-            let rh = hashable_noun_digest(cell.tail, arena)?;
-            Ok(hash_ten_cell(lh, rh).map_err(|e| js_err(format!("{e:?}")))?)
+    if let Some(commitments) = &branch.hashlock {
+        if commitments.is_empty() {
+            return Err("hashlock requires a commitment".into());
         }
-    }
-}
-
-fn hash_note_data(map: Noun, arena: &Arena) -> Result<[u64; 5], JsValue> {
-    // note-data hashable: empty map hashes as leaf+0
-    if map == arena.atom0() {
-        return Ok(hash_noun_varlen(arena.atom0(), arena).map_err(|e| js_err(format!("{e:?}")))?);
-    }
-
-    let (node, left, right) =
-        decompose_map(map, arena).ok_or_else(|| js_err("malformed note-data"))?;
-    let (key, value) =
-        decompose_pair(node, arena).ok_or_else(|| js_err("malformed note-data node"))?;
-
-    let key_digest = hash_noun_varlen(key, arena).map_err(|e| js_err(format!("{e:?}")))?;
-    let value_digest = hashable_noun_digest(value, arena)?;
-    let node_digest =
-        hash_ten_cell(key_digest, value_digest).map_err(|e| js_err(format!("{e:?}")))?;
-
-    let left_digest = hash_note_data(left, arena)?;
-    let right_digest = hash_note_data(right, arena)?;
-    let children_digest =
-        hash_ten_cell(left_digest, right_digest).map_err(|e| js_err(format!("{e:?}")))?;
-    Ok(hash_ten_cell(node_digest, children_digest).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-fn hash_nname_hashable(noun: Noun, arena: &Arena) -> Result<[u64; 5], JsValue> {
-    let (first_noun, rest) = uncons(noun, arena).ok_or_else(|| js_err("malformed nname"))?;
-    let (second_noun, end) = uncons(rest, arena).ok_or_else(|| js_err("malformed nname"))?;
-    let first = parse_hash(first_noun, arena).ok_or_else(|| js_err("malformed nname hash"))?;
-    let second = parse_hash(second_noun, arena).ok_or_else(|| js_err("malformed nname hash"))?;
-    let end_digest = hash_noun_varlen(end, arena).map_err(|e| js_err(format!("{e:?}")))?;
-    let tail = hash_ten_cell(second, end_digest).map_err(|e| js_err(format!("{e:?}")))?;
-    Ok(hash_ten_cell(first, tail).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-fn hash_zset_hashes(set: Noun, arena: &Arena, ctx: &TxIdCtx) -> Result<[u64; 5], JsValue> {
-    if set == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-    let (value, left, right) = tuple3(set, arena).ok_or_else(|| js_err("malformed zset"))?;
-    let value_digest = parse_hash(value, arena).ok_or_else(|| js_err("malformed hash in zset"))?;
-    let left_digest = hash_zset_hashes(left, arena, ctx)?;
-    let right_digest = hash_zset_hashes(right, arena, ctx)?;
-    let children_digest =
-        hash_ten_cell(left_digest, right_digest).map_err(|e| js_err(format!("{e:?}")))?;
-    Ok(hash_ten_cell(value_digest, children_digest).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-fn hash_optional_leaf(opt: Noun, arena: &Arena, ctx: &TxIdCtx) -> Result<[u64; 5], JsValue> {
-    if opt == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-    let (tag, value) = tuple2(opt, arena).ok_or_else(|| js_err("malformed option"))?;
-    if tag != arena.atom0() {
-        return Err(js_err("malformed option tag"));
-    }
-    let value_digest = hash_noun_varlen(value, arena).map_err(|e| js_err(format!("{e:?}")))?;
-    Ok(hash_ten_cell(ctx.null_digest, value_digest).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-fn hash_timelock_range(range: Noun, arena: &Arena, ctx: &TxIdCtx) -> Result<[u64; 5], JsValue> {
-    let (min, max) = tuple2(range, arena).ok_or_else(|| js_err("malformed timelock range"))?;
-    let min_digest = hash_optional_leaf(min, arena, ctx)?;
-    let max_digest = hash_optional_leaf(max, arena, ctx)?;
-    Ok(hash_ten_cell(min_digest, max_digest).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-fn hash_lock_primitive_hashable(
-    lp: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], JsValue> {
-    let (header, body) = tuple2(lp, arena).ok_or_else(|| js_err("malformed lock primitive"))?;
-    let Noun::Atom(header_id) = header else {
-        return Err(js_err("malformed lock primitive header"));
-    };
-
-    if arena.atom_eq_bytes(header_id, b"pkh") {
-        let (m, h) = tuple2(body, arena).ok_or_else(|| js_err("malformed pkh lock"))?;
-        let tag_digest = hash_noun_varlen(header, arena).map_err(|e| js_err(format!("{e:?}")))?;
-        let m_digest = hash_noun_varlen(m, arena).map_err(|e| js_err(format!("{e:?}")))?;
-        let h_digest = hash_zset_hashes(h, arena, ctx)?;
-        let inner = hash_ten_cell(m_digest, h_digest).map_err(|e| js_err(format!("{e:?}")))?;
-        return Ok(hash_ten_cell(tag_digest, inner).map_err(|e| js_err(format!("{e:?}")))?);
-    }
-
-    if arena.atom_eq_bytes(header_id, b"tim") {
-        let (rel, abs) = tuple2(body, arena).ok_or_else(|| js_err("malformed tim lock"))?;
-        let tag_digest = hash_noun_varlen(header, arena).map_err(|e| js_err(format!("{e:?}")))?;
-        let rel_digest = hash_timelock_range(rel, arena, ctx)?;
-        let abs_digest = hash_timelock_range(abs, arena, ctx)?;
-        let inner = hash_ten_cell(rel_digest, abs_digest).map_err(|e| js_err(format!("{e:?}")))?;
-        return Ok(hash_ten_cell(tag_digest, inner).map_err(|e| js_err(format!("{e:?}")))?);
-    }
-
-    if arena.atom_eq_bytes(header_id, b"hax") {
-        // `%hax` body is a z-set of preimage-commitment hashes, hashed exactly
-        // like `%pkh`'s hash set (matches nockchain `hashable:hax`).
-        let tag_digest = hash_noun_varlen(header, arena).map_err(|e| js_err(format!("{e:?}")))?;
-        let h_digest = hash_zset_hashes(body, arena, ctx)?;
-        return Ok(hash_ten_cell(tag_digest, h_digest).map_err(|e| js_err(format!("{e:?}")))?);
-    }
-
-    if arena.atom_eq_bytes(header_id, b"brn") {
-        let tag_digest = hash_noun_varlen(header, arena).map_err(|e| js_err(format!("{e:?}")))?;
-        return Ok(
-            hash_ten_cell(tag_digest, ctx.null_digest).map_err(|e| js_err(format!("{e:?}")))?
+        let set = ZSet::gas(
+            commitments
+                .iter()
+                .map(|text| hash(text))
+                .collect::<Result<Vec<_>, _>>()?,
         );
+        result.p.push(LockPrimitive {
+            header: "hax".into(),
+            body: LockPrimitiveBody::Hax(Hax { set }),
+        });
     }
-
-    Err(js_err("unsupported lock primitive"))
-}
-
-fn hash_lock_primitives_list(
-    prims: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], JsValue> {
-    if prims == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-    let (head, tail) =
-        uncons(prims, arena).ok_or_else(|| js_err("malformed lock primitive list"))?;
-    let head_digest = hash_lock_primitive_hashable(head, arena, ctx)?;
-    let tail_digest = hash_lock_primitives_list(tail, arena, ctx)?;
-    Ok(hash_ten_cell(head_digest, tail_digest).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-fn hash_merkle_proof_hashable(
-    merk: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], JsValue> {
-    let (root_noun, path) = tuple2(merk, arena).ok_or_else(|| js_err("malformed merkle proof"))?;
-    let root = parse_hash(root_noun, arena).ok_or_else(|| js_err("malformed merkle root"))?;
-    let path_digest = hash_hash_list_hashes(path, arena, ctx)?;
-    Ok(hash_ten_cell(root, path_digest).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-fn hash_hash_list_hashes(list: Noun, arena: &Arena, ctx: &TxIdCtx) -> Result<[u64; 5], JsValue> {
-    if list == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-    let (head, tail) = uncons(list, arena).ok_or_else(|| js_err("malformed hash list"))?;
-    let head_digest = parse_hash(head, arena).ok_or_else(|| js_err("malformed hash in list"))?;
-    let tail_digest = hash_hash_list_hashes(tail, arena, ctx)?;
-    Ok(hash_ten_cell(head_digest, tail_digest).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-fn hash_lock_merkle_proof_hashable(
-    lmp: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], JsValue> {
-    let (version, spend_condition, axis, merk_proof) = decompose_lock_merkle_proof(lmp, arena)?;
-    let spend_condition_hash = hash_lock_primitives_list(spend_condition, arena, ctx)?;
-    let merk_digest = hash_merkle_proof_hashable(merk_proof, arena, ctx)?;
-
-    match version {
-        Some(version) => {
-            let version_digest =
-                hash_noun_varlen(version, arena).map_err(|e| js_err(format!("{e:?}")))?;
-            let axis_digest =
-                hash_noun_varlen(axis, arena).map_err(|e| js_err(format!("{e:?}")))?;
-            let inner =
-                hash_ten_cell(axis_digest, merk_digest).map_err(|e| js_err(format!("{e:?}")))?;
-            let inner =
-                hash_ten_cell(spend_condition_hash, inner).map_err(|e| js_err(format!("{e:?}")))?;
-            Ok(hash_ten_cell(version_digest, inner).map_err(|e| js_err(format!("{e:?}")))?)
-        }
-        None => {
-            let axis_digest =
-                digest_from_b58(LOCK_MERKLE_AXIS_HASH_B58).map_err(|e| js_err(format!("{e:?}")))?;
-            let inner =
-                hash_ten_cell(axis_digest, merk_digest).map_err(|e| js_err(format!("{e:?}")))?;
-            Ok(hash_ten_cell(spend_condition_hash, inner).map_err(|e| js_err(format!("{e:?}")))?)
-        }
-    }
-}
-
-fn hash_hax_map_hashable(map: Noun, arena: &Arena, ctx: &TxIdCtx) -> Result<[u64; 5], JsValue> {
-    if map == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-    let (node, left, right) =
-        decompose_map(map, arena).ok_or_else(|| js_err("malformed hax map"))?;
-    let (key, value) =
-        decompose_pair(node, arena).ok_or_else(|| js_err("malformed hax map node"))?;
-
-    let key_digest = parse_hash(key, arena).ok_or_else(|| js_err("malformed hax key"))?;
-    let value_digest = hashable_noun_digest(value, arena)?;
-    let node_digest =
-        hash_ten_cell(key_digest, value_digest).map_err(|e| js_err(format!("{e:?}")))?;
-
-    let left_digest = hash_hax_map_hashable(left, arena, ctx)?;
-    let right_digest = hash_hax_map_hashable(right, arena, ctx)?;
-    let children_digest =
-        hash_ten_cell(left_digest, right_digest).map_err(|e| js_err(format!("{e:?}")))?;
-    Ok(hash_ten_cell(node_digest, children_digest).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-fn hash_pkh_signature_value_hashable(value: Noun, arena: &Arena) -> Result<[u64; 5], JsValue> {
-    let (pk, sig) = tuple2(value, arena).ok_or_else(|| js_err("malformed pkh signature value"))?;
-    let pk_digest = hash_noun_varlen(pk, arena).map_err(|e| js_err(format!("{e:?}")))?;
-    let sig_digest = hash_noun_varlen(sig, arena).map_err(|e| js_err(format!("{e:?}")))?;
-    Ok(hash_ten_cell(pk_digest, sig_digest).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-fn hash_pkh_signature_map_hashable(
-    map: Noun,
-    arena: &Arena,
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], JsValue> {
-    if map == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-    let (node, left, right) =
-        decompose_map(map, arena).ok_or_else(|| js_err("malformed pkh map"))?;
-    let (key, value) =
-        decompose_pair(node, arena).ok_or_else(|| js_err("malformed pkh map node"))?;
-
-    let key_digest = parse_hash(key, arena).ok_or_else(|| js_err("malformed pkh key"))?;
-    let value_digest = hash_pkh_signature_value_hashable(value, arena)?;
-    let node_digest =
-        hash_ten_cell(key_digest, value_digest).map_err(|e| js_err(format!("{e:?}")))?;
-
-    let left_digest = hash_pkh_signature_map_hashable(left, arena, ctx)?;
-    let right_digest = hash_pkh_signature_map_hashable(right, arena, ctx)?;
-    let children_digest =
-        hash_ten_cell(left_digest, right_digest).map_err(|e| js_err(format!("{e:?}")))?;
-    Ok(hash_ten_cell(node_digest, children_digest).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-fn hash_seed_regular_hashable(seed: Noun, arena: &Arena) -> Result<[u64; 5], JsValue> {
-    let (_output_source, lock_root_noun, note_data_noun, gift_noun, parent_hash_noun) =
-        tuple5(seed, arena).ok_or_else(|| js_err("malformed seed"))?;
-
-    let lock_root =
-        parse_hash(lock_root_noun, arena).ok_or_else(|| js_err("malformed seed lock-root"))?;
-    let note_data_hash = hash_note_data(note_data_noun, arena)?;
-    let gift_digest = hash_noun_varlen(gift_noun, arena).map_err(|e| js_err(format!("{e:?}")))?;
-    let parent_hash =
-        parse_hash(parent_hash_noun, arena).ok_or_else(|| js_err("malformed seed parent-hash"))?;
-
-    let mut acc = parent_hash;
-    acc = hash_ten_cell(gift_digest, acc).map_err(|e| js_err(format!("{e:?}")))?;
-    acc = hash_ten_cell(note_data_hash, acc).map_err(|e| js_err(format!("{e:?}")))?;
-    Ok(hash_ten_cell(lock_root, acc).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-fn hash_seeds_regular(seeds_zset: Noun, arena: &Arena, ctx: &TxIdCtx) -> Result<[u64; 5], JsValue> {
-    if seeds_zset == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-
-    let (seed, lr) = uncons(seeds_zset, arena).ok_or_else(|| js_err("malformed seeds zset"))?;
-    let (left, right) = uncons(lr, arena).ok_or_else(|| js_err("malformed seeds zset"))?;
-
-    let node_digest = hash_seed_regular_hashable(seed, arena)?;
-    let left_digest = hash_seeds_regular(left, arena, ctx)?;
-    let right_digest = hash_seeds_regular(right, arena, ctx)?;
-    let children_digest =
-        hash_ten_cell(left_digest, right_digest).map_err(|e| js_err(format!("{e:?}")))?;
-    Ok(hash_ten_cell(node_digest, children_digest).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-fn hash_witness_hashable(witness: Noun, arena: &Arena, ctx: &TxIdCtx) -> Result<[u64; 5], JsValue> {
-    let (lmp, pkh_map, hax, tim) =
-        tuple4(witness, arena).ok_or_else(|| js_err("malformed witness"))?;
-
-    let lmp_hash = hash_lock_merkle_proof_hashable(lmp, arena, ctx)?;
-    let pkh_hash = hash_pkh_signature_map_hashable(pkh_map, arena, ctx)?;
-    let hax_hash = hash_hax_map_hashable(hax, arena, ctx)?;
-    let tim_digest = hash_noun_varlen(tim, arena).map_err(|e| js_err(format!("{e:?}")))?;
-
-    let mut acc = tim_digest;
-    acc = hash_ten_cell(hax_hash, acc).map_err(|e| js_err(format!("{e:?}")))?;
-    acc = hash_ten_cell(pkh_hash, acc).map_err(|e| js_err(format!("{e:?}")))?;
-    Ok(hash_ten_cell(lmp_hash, acc).map_err(|e| js_err(format!("{e:?}")))?)
+    Ok(result)
 }
 
-fn hash_spend_v1_hashable(spend: Noun, arena: &Arena, ctx: &TxIdCtx) -> Result<[u64; 5], JsValue> {
-    let (ver_noun, body_noun) = tuple2(spend, arena).ok_or_else(|| js_err("malformed spend"))?;
-    if noun_atom_u64(ver_noun, arena) != Some(1) {
-        return Err(js_err("unsupported spend version"));
-    }
-
-    let (witness, seeds, fee) =
-        tuple3(body_noun, arena).ok_or_else(|| js_err("malformed spend body"))?;
-    let witness_digest = hash_witness_hashable(witness, arena, ctx)?;
-    let seeds_digest = hash_seeds_regular(seeds, arena, ctx)?;
-    let fee_digest = hash_noun_varlen(fee, arena).map_err(|e| js_err(format!("{e:?}")))?;
-
-    let inner = hash_ten_cell(seeds_digest, fee_digest).map_err(|e| js_err(format!("{e:?}")))?;
-    let body_digest = hash_ten_cell(witness_digest, inner).map_err(|e| js_err(format!("{e:?}")))?;
-    let ver_digest = hash_noun_varlen(ver_noun, arena).map_err(|e| js_err(format!("{e:?}")))?;
-    Ok(hash_ten_cell(ver_digest, body_digest).map_err(|e| js_err(format!("{e:?}")))?)
+fn branch_lock(branches: &[LockBranch]) -> Result<Lock, String> {
+    Lock::from_list(branches.iter().map(condition).collect::<Result<_, _>>()?)
+        .map_err(|error| error.to_string())
 }
 
-fn hash_spends_hashable(spends: Noun, arena: &Arena, ctx: &TxIdCtx) -> Result<[u64; 5], JsValue> {
-    if spends == arena.atom0() {
-        return Ok(ctx.null_digest);
-    }
-
-    let (node, left, right) =
-        decompose_map(spends, arena).ok_or_else(|| js_err("malformed spends"))?;
-    let (name_noun, spend_noun) =
-        decompose_pair(node, arena).ok_or_else(|| js_err("malformed spends node"))?;
-
-    let name_digest = hash_nname_hashable(name_noun, arena)?;
-    let spend_digest = hash_spend_v1_hashable(spend_noun, arena, ctx)?;
-    let node_digest =
-        hash_ten_cell(name_digest, spend_digest).map_err(|e| js_err(format!("{e:?}")))?;
-
-    let left_digest = hash_spends_hashable(left, arena, ctx)?;
-    let right_digest = hash_spends_hashable(right, arena, ctx)?;
-    let children_digest =
-        hash_ten_cell(left_digest, right_digest).map_err(|e| js_err(format!("{e:?}")))?;
-    Ok(hash_ten_cell(node_digest, children_digest).map_err(|e| js_err(format!("{e:?}")))?)
+fn output(input: &OutputInput) -> Result<PlannedOutput, String> {
+    let lock = if let Some(branches) = &input.or_branches {
+        branch_lock(branches)?
+    } else {
+        Lock::SpendCondition(condition(&LockBranch {
+            recipient: Some(input.recipient.clone()),
+            timelock: input.timelock.clone(),
+            hashlock: input.hashlock.clone(),
+            burn: input.burn,
+        })?)
+    };
+    Ok(PlannedOutput {
+        lock_root: lock.hash(),
+        amount: input.amount,
+        note_data: if input.lock_root_only {
+            NoteData { map: ZMap::new() }
+        } else {
+            NoteData::from_lock(lock).map_err(|error| error.to_string())?
+        },
+    })
 }
 
-fn compute_tx_id_v1(spends: Noun, arena: &Arena, ctx: &TxIdCtx) -> Result<[u64; 5], JsValue> {
-    let spends_digest = hash_spends_hashable(spends, arena, ctx)?;
-    Ok(hash_ten_cell(ctx.version_digest, spends_digest).map_err(|e| js_err(format!("{e:?}")))?)
+struct SourceMatcher {
+    signer: SigningKeyLockMatcher,
+    supplied: Option<LockResolution>,
 }
 
-fn count_leaves(noun: Noun, arena: &Arena) -> u64 {
-    match noun {
-        Noun::Atom(_) => 1,
-        Noun::Cell(id) => {
-            let cell = arena.cell(id);
-            count_leaves(cell.head, arena) + count_leaves(cell.tail, arena)
+impl LockMatcher for SourceMatcher {
+    fn resolve(&self, note: &NNoteV1) -> Option<LockResolution> {
+        if let Some(supplied) = &self.supplied {
+            Some(supplied.clone())
+        } else {
+            self.signer.resolve(note)
         }
     }
 }
 
-#[derive(Debug, Clone, Copy)]
-struct FeeBreakdown {
-    seed_words: u64,
-    witness_words: u64,
-    minimum_fee: u64,
-}
-
-fn fee_policy_from_input(input: &ComposeTxV1Input) -> FeePolicy {
-    let mut policy = FeePolicy::default();
-    if let Some(v) = input.bythos_phase {
-        policy.bythos_phase = v;
+fn source_matcher(input: &ComposeTxV1Input) -> Result<SourceMatcher, String> {
+    if input.source_multisig.is_some() && input.source_or_lock.is_some() {
+        return Err("choose one source lock description".into());
     }
-    if let Some(v) = input.base_fee {
-        policy.base_fee = v;
-    }
-    if let Some(v) = input.input_fee_divisor {
-        policy.input_fee_divisor = v;
-    }
-    if let Some(v) = input.min_fee {
-        policy.min_fee = v;
+    let signer = SigningKeyLockMatcher {
+        signer_pkh: hash(&input.source_pkh)?,
+        public_key: None,
+        coinbase_relative_min: Some(input.coinbase_rel_min.unwrap_or(100)),
+    };
+    let supplied = if let Some(source) = &input.source_or_lock {
+        let lock = branch_lock(&source.branches)?;
+        if source.spend_branch >= source.branches.len() as u64 {
+            return Err("spend branch is out of range".into());
+        }
+        let mut preimages = ZMap::new();
+        for bytes in &source.preimages {
+            let noun = UntypedNoun {
+                p: bytes.clone().into(),
+            };
+            let digest =
+                tx_types::hash_hashable(&noun.to_hashable().map_err(|error| error.to_string())?)
+                    .map_err(|error| error.to_string())?;
+            preimages.put(digest, noun);
+        }
+        let selected = &lock.flatten_spend_conditions()[source.spend_branch as usize];
+        let signature_count = selected
+            .required_pkh_policy()
+            .map_or(0, |policy| policy.threshold as u64);
+        Some(LockResolution {
+            lock,
+            leaf_number: source.spend_branch + 1,
+            signature_count,
+            preimages,
+            fund_maturity: None,
+        })
+    } else if let Some(source) = &input.source_multisig {
+        let condition = recipient_condition(&RecipientInput::Multisig {
+            m: source.m,
+            pkhs: source.pkhs.clone(),
+        })?;
+        Some(LockResolution {
+            lock: Lock::SpendCondition(condition),
+            leaf_number: 1,
+            signature_count: source.m,
+            preimages: ZMap::new(),
+            fund_maturity: None,
+        })
+    } else {
+        None
+    };
+    Ok(SourceMatcher { signer, supplied })
+}
+
+#[derive(Clone)]
+struct WalletTransaction {
+    name: String,
+    spends: SpendsV1,
+    display: UntypedNoun,
+    witnesses: ZMap<NName, Witness>,
+}
+
+impl Encode for WalletTransaction {
+    fn encode(&self, arena: &mut Arena) -> Result<Noun, Error> {
+        let witnesses = (1u64, &self.witnesses).encode(arena)?;
+        let fields = [
+            1u64.encode(arena)?,
+            self.name.encode(arena)?,
+            self.spends.encode(arena)?,
+            self.display.encode(arena)?,
+            witnesses,
+        ];
+        tuple(arena, &fields)
     }
-    policy
 }
 
-/// Hoon `num-of-leaves` over the `(~(rep z-by note-data) ...)` accumulator:
-/// two leaves per atom-valued entry plus the terminal `~` (`2n+1`).
-fn count_note_data_words(note_data: Noun, arena: &Arena) -> Result<u64, JsValue> {
-    fn walk(map: Noun, arena: &Arena, words: &mut u64) -> Result<(), JsValue> {
-        if map == arena.atom0() {
-            return Ok(());
+impl Decode for WalletTransaction {
+    fn decode(noun: Noun, arena: &Arena) -> Result<Self, Error> {
+        let mut fields = Fields::new(noun, 5);
+        if u64::decode(fields.next(arena)?, arena)? != 1 {
+            return Err(Error("wallet transaction must be V1"));
         }
-        let (node, left, right) =
-            decompose_map(map, arena).ok_or_else(|| js_err("malformed note-data map"))?;
-        let (key, value) =
-            decompose_pair(node, arena).ok_or_else(|| js_err("malformed note-data node"))?;
-        *words = words
-            .checked_add(count_leaves(key, arena))
-            .and_then(|w| w.checked_add(count_leaves(value, arena)))
-            .ok_or_else(|| js_err("note-data word count overflow"))?;
-        walk(left, arena, words)?;
-        walk(right, arena, words)
-    }
-    let mut words = 1;
-    walk(note_data, arena, &mut words)?;
-    Ok(words)
-}
-
-fn merge_note_data_into(arena: &mut Arena, src: Noun, dst: &mut Noun) -> Result<(), JsValue> {
-    if src == arena.atom0() {
-        return Ok(());
-    }
-    let (node, left, right) =
-        decompose_map(src, arena).ok_or_else(|| js_err("malformed note-data map"))?;
-    let (key, value) =
-        decompose_pair(node, arena).ok_or_else(|| js_err("malformed note-data node"))?;
-    *dst =
-        canonical_zmap_put(arena, *dst, key, value).map_err(|e| js_err(format!("zmap: {e:?}")))?;
-    merge_note_data_into(arena, left, dst)?;
-    merge_note_data_into(arena, right, dst)
-}
-
-fn collect_seed_note_data(
-    arena: &mut Arena,
-    seeds: Noun,
-    merged: &mut Vec<([u64; 5], Noun)>,
-    legacy_words: &mut u64,
-    bythos_active: bool,
-) -> Result<(), JsValue> {
-    if seeds == arena.atom0() {
-        return Ok(());
-    }
-    let (seed, lr) = uncons(seeds, arena).ok_or_else(|| js_err("malformed seeds set"))?;
-    let (left, right) = uncons(lr, arena).ok_or_else(|| js_err("malformed seeds children"))?;
-    let (_output_source, lock_root_noun, note_data, _gift, _parent_hash) =
-        tuple5(seed, arena).ok_or_else(|| js_err("malformed seed"))?;
-
-    if bythos_active {
-        let lock_root =
-            parse_hash(lock_root_noun, arena).ok_or_else(|| js_err("malformed seed lock root"))?;
-        if let Some((_root, data)) = merged.iter_mut().find(|(root, _)| *root == lock_root) {
-            merge_note_data_into(arena, note_data, data)?;
-        } else {
-            let mut data = arena.atom0();
-            merge_note_data_into(arena, note_data, &mut data)?;
-            merged.push((lock_root, data));
+        let name = String::decode(fields.next(arena)?, arena)?;
+        let spends = SpendsV1::decode(fields.next(arena)?, arena)?;
+        let display = UntypedNoun::decode(fields.next(arena)?, arena)?;
+        let (tag, witnesses) = <(u64, ZMap<NName, Witness>)>::decode(fields.next(arena)?, arena)?;
+        if tag != 1 {
+            return Err(Error("wallet witness data must be V1"));
         }
-    } else {
-        *legacy_words = legacy_words
-            .checked_add(count_note_data_words(note_data, arena)?)
-            .ok_or_else(|| js_err("note-data word count overflow"))?;
+        Ok(Self {
+            name,
+            spends,
+            display,
+            witnesses,
+        })
     }
-
-    collect_seed_note_data(arena, left, merged, legacy_words, bythos_active)?;
-    collect_seed_note_data(arena, right, merged, legacy_words, bythos_active)
 }
 
-fn collect_spend_words(
-    arena: &mut Arena,
-    spends: Noun,
-    merged: &mut Vec<([u64; 5], Noun)>,
-    legacy_seed_words: &mut u64,
-    witness_words: &mut u64,
-    bythos_active: bool,
-) -> Result<(), JsValue> {
-    if spends == arena.atom0() {
-        return Ok(());
-    }
-
-    let (node, left, right) =
-        decompose_map(spends, arena).ok_or_else(|| js_err("malformed spends"))?;
-    let (_name, spend) =
-        decompose_pair(node, arena).ok_or_else(|| js_err("malformed spend entry"))?;
-    let (version, body) = tuple2(spend, arena).ok_or_else(|| js_err("malformed spend"))?;
-    if noun_atom_u64(version, arena) != Some(1) {
-        return Err(js_err("composer fee calculation only supports V1 spends"));
-    }
-    let (witness, seeds, _fee) =
-        tuple3(body, arena).ok_or_else(|| js_err("malformed spend body"))?;
-    *witness_words = witness_words.saturating_add(count_leaves(witness, arena));
-    collect_seed_note_data(arena, seeds, merged, legacy_seed_words, bythos_active)?;
-
-    collect_spend_words(
-        arena,
-        left,
-        merged,
-        legacy_seed_words,
-        witness_words,
-        bythos_active,
-    )?;
-    collect_spend_words(
-        arena,
-        right,
-        merged,
-        legacy_seed_words,
-        witness_words,
-        bythos_active,
+fn compose(
+    input: ComposeTxV1Input,
+    order: SelectionOrder,
+) -> Result<ComposedTransactionV1, String> {
+    let matcher = source_matcher(&input)?;
+    let notes = input
+        .notes
+        .iter()
+        .map(|note| {
+            Ok(NNote::V1(NNoteV1 {
+                version: note.version,
+                origin_page: PageNumber {
+                    value: note.origin_page,
+                },
+                name: NName {
+                    p: vec![hash(&note.name_first)?, hash(&note.name_last)?],
+                },
+                assets: Coins { value: note.assets },
+                note_data: tx_types::rpc_note_data::note_data_from_json(&note.note_data)?,
+            }))
+        })
+        .collect::<Result<Vec<_>, String>>()?;
+    let outputs = input
+        .outputs
+        .iter()
+        .map(output)
+        .collect::<Result<Vec<_>, _>>()?;
+    let refund_lock = matcher
+        .supplied
+        .as_ref()
+        .map(|source| source.lock.clone())
+        .unwrap_or_else(|| {
+            Lock::SpendCondition(tx_types::lock_resolver::simple_pkh(
+                matcher.signer.signer_pkh.clone(),
+            ))
+        });
+    let refund = PlannedOutput {
+        lock_root: refund_lock.hash(),
+        amount: 0,
+        note_data: NoteData::from_lock(refund_lock).map_err(|error| error.to_string())?,
+    };
+    let chain = ChainContext {
+        candidate_height: input.current_height,
+        fee_height: input
+            .current_height
+            .unwrap_or(input.bythos_phase.unwrap_or(tx_types::fee::BYTHOS_PHASE)),
+        bythos_phase: input.bythos_phase.unwrap_or(tx_types::fee::BYTHOS_PHASE),
+        base_fee: input.base_fee.unwrap_or(tx_types::fee::BASE_FEE),
+        input_fee_divisor: input
+            .input_fee_divisor
+            .unwrap_or(tx_types::fee::INPUT_FEE_DIVISOR),
+        min_fee: input.min_fee.unwrap_or(tx_types::fee::MIN_FEE),
+    };
+    let plan = planner::plan(
+        PlanRequest {
+            candidates: &notes,
+            outputs: &outputs,
+            refund: &refund,
+            selection: if input.manual_inputs {
+                planner::SelectionMode::Manual(
+                    notes
+                        .iter()
+                        .map(|note| match note {
+                            NNote::V1(note) => note.name.clone(),
+                            _ => unreachable!(),
+                        })
+                        .collect(),
+                )
+            } else {
+                planner::SelectionMode::Auto
+            },
+            order,
+            version: planner::CandidateVersionPolicy::V1Only,
+            mode: planner::PlanningMode::Standard,
+            fee: planner::FeePolicy::Minimum,
+            chain: chain.clone(),
+        },
+        &matcher,
     )
-}
-
-fn calculate_transaction_fee(
-    arena: &mut Arena,
-    spends: Noun,
-    current_height: u64,
-    fee_policy: FeePolicy,
-) -> Result<FeeBreakdown, JsValue> {
-    let bythos_active = current_height >= fee_policy.bythos_phase;
-    let mut merged = Vec::<([u64; 5], Noun)>::new();
-    let mut legacy_seed_words = 0u64;
-    let mut witness_words = 0u64;
-    collect_spend_words(
-        arena,
-        spends,
-        &mut merged,
-        &mut legacy_seed_words,
-        &mut witness_words,
-        bythos_active,
-    )?;
-    let mut merged_seed_words = 0u64;
-    for (_root, note_data) in merged.iter() {
-        merged_seed_words = merged_seed_words
-            .checked_add(count_note_data_words(*note_data, arena)?)
-            .ok_or_else(|| js_err("note-data word count overflow"))?;
+    .map_err(|error| error.to_string())?;
+    let id = tx_types::compute_tx_id_v1(&plan.spends).map_err(|error| error.to_string())?;
+    let mut display = ZMap::new();
+    let mut witnesses = ZMap::new();
+    let mut summary_spends = Vec::new();
+    for (name, spend) in plan.spends.map.tap() {
+        let SpendBody::V1(body) = spend.body else {
+            return Err("composer requires V1 inputs".into());
+        };
+        display.put(name.clone(), body.witness.lmp.spend_condition().clone());
+        witnesses.put(name.clone(), body.witness);
+        summary_spends.push(serde_json::json!({
+            "input": format!("{} {}", name.p[0].to_b58(), name.p[1].to_b58()), "fee": body.fee.value,
+            "refund": plan.refunds.iter().find(|(input, _)| input == &name).map_or(0, |(_, value)| *value),
+            "seeds": body.seeds.set.tap().iter().map(|seed| serde_json::json!({
+                "recipient": seed.lock_root.to_b58(), "gift": seed.gift.value,
+            })).collect::<Vec<_>>(),
+        }));
     }
-    let seed_words = legacy_seed_words.saturating_add(merged_seed_words);
-    let effective_base_fee = if bythos_active {
-        fee_policy.base_fee
-    } else {
-        fee_policy.base_fee.saturating_mul(2)
+    let wallet = WalletTransaction {
+        name: id.to_b58(),
+        spends: plan.spends.clone(),
+        witnesses,
+        display: UntypedNoun::from_value(&((1u64, display), 0u64))
+            .map_err(|error| error.to_string())?,
     };
-    let witness_divisor = if bythos_active {
-        fee_policy.input_fee_divisor.max(1)
-    } else {
-        1
+    let summary_inputs = plan
+        .selected
+        .iter()
+        .map(|name| {
+            let note = notes
+                .iter()
+                .find_map(|note| match note {
+                    NNote::V1(note) if note.name == *name => Some(note),
+                    _ => None,
+                })
+                .unwrap();
+            serde_json::json!({ "name_first": name.p[0].to_b58(), "name_last": name.p[1].to_b58(),
+            "assets": note.assets.value, "capacity": note.assets.value })
+        })
+        .collect::<Vec<_>>();
+    let raw = RawTransactionV1 {
+        version: 1,
+        id: id.clone(),
+        spends: plan.spends,
     };
-    let seed_fee = seed_words.saturating_mul(effective_base_fee);
-    let witness_fee = witness_words
-        .saturating_mul(effective_base_fee)
-        .saturating_div(witness_divisor);
-    let minimum_fee = seed_fee.saturating_add(witness_fee).max(fee_policy.min_fee);
-
-    Ok(FeeBreakdown {
-        seed_words,
-        witness_words,
-        minimum_fee,
+    let summary = serde_json::json!({
+        "tx_id": id.to_b58(), "source_pkh": input.source_pkh, "outputs": input.outputs,
+        "inputs_used": summary_inputs, "spends": summary_spends, "total_fees": plan.final_fee,
+        "minimum_fee": plan.minimum_fee, "seed_words": plan.word_counts.seed_words,
+        "witness_words": plan.word_counts.witness_words, "coinbase_rel_min": input.coinbase_rel_min.unwrap_or(100),
+        "current_height": chain.candidate_height, "bythos_phase": chain.bythos_phase,
+        "base_fee": chain.base_fee, "input_fee_divisor": chain.input_fee_divisor, "min_fee": chain.min_fee,
+    });
+    Ok(ComposedTransactionV1 {
+        tx_id: id.to_b58(),
+        raw_jam: raw.to_jam().map_err(|error| error.to_string())?,
+        wallet_jam: wallet.to_jam().map_err(|error| error.to_string())?,
+        summary_json: summary.to_string(),
     })
 }
 
-fn parse_b58_hash(s: &str) -> Result<[u64; 5], JsValue> {
-    let h = tx_types::transaction_types::Hash::from_b58(s)
-        .map_err(|e| js_err(format!("invalid base58 hash: {e}")))?;
-    Ok(h.values)
+#[wasm_bindgen]
+pub fn compose_tx_v1_unsigned(input: JsValue) -> Result<ComposedTransactionV1, JsValue> {
+    let input = serde_wasm_bindgen::from_value(input).map_err(js_err)?;
+    compose(input, SelectionOrder::Ascending).map_err(js_err)
 }
 
-fn hash_to_b58(digest: [u64; 5]) -> String {
-    tx_types::transaction_types::Hash { values: digest }.to_b58()
+#[wasm_bindgen]
+pub fn compose_tx_v1_min_inputs(input: JsValue) -> Result<ComposedTransactionV1, JsValue> {
+    let input = serde_wasm_bindgen::from_value(input).map_err(js_err)?;
+    compose(input, SelectionOrder::Descending).map_err(js_err)
 }
 
-fn recipient_lock_and_display_address(
-    arena: &mut Arena,
-    recipient: &RecipientInput,
-    ctx: &TxIdCtx,
-) -> Result<(Noun, String), JsValue> {
-    match recipient {
-        RecipientInput::Pkh(b58) => {
-            let digest = parse_b58_hash(b58)?;
-            Ok((build_pkh_lock(arena, digest)?, b58.to_string()))
-        }
-        RecipientInput::Multisig { m, pkhs } => {
-            if *m == 0 {
-                return Err(js_err("multisig requires m >= 1"));
-            }
-            if pkhs.is_empty() {
-                return Err(js_err("multisig requires at least 1 signer"));
-            }
-            let mut digests: Vec<[u64; 5]> = Vec::with_capacity(pkhs.len());
-            for pkh_b58 in pkhs {
-                digests.push(parse_b58_hash(pkh_b58)?);
-            }
-            digests.sort();
-            digests.dedup();
-            if (*m as usize) > digests.len() {
-                return Err(js_err("multisig requires m <= number of unique signers"));
-            }
-
-            let lock = build_pkh_lock_multisig(arena, *m, &digests)?;
-            let lock_list = build_list(arena, &[lock]);
-            let lock_root = hash_lock_primitives_list(lock_list, arena, ctx)?;
-            Ok((lock, hash_to_b58(lock_root)))
-        }
-    }
+pub fn estimate_tx_v1_fee(input: ComposeTxV1Input) -> Result<u64, String> {
+    let composed = compose(input, SelectionOrder::Descending)?;
+    let summary: serde_json::Value =
+        serde_json::from_str(&composed.summary_json).map_err(|error| error.to_string())?;
+    summary["total_fees"]
+        .as_u64()
+        .ok_or_else(|| "missing planned fee".into())
 }
 
-#[derive(Debug, Clone)]
-struct SeedSpec {
-    lock_root: [u64; 5],
-    note_data: Noun,
-    gift: u64,
-    recipient_b58: String,
+#[wasm_bindgen]
+pub fn compose_tx_v1_recipient_address(recipient: JsValue) -> Result<String, JsValue> {
+    let recipient: RecipientInput = serde_wasm_bindgen::from_value(recipient).map_err(js_err)?;
+    let condition = recipient_condition(&recipient).map_err(js_err)?;
+    Ok(match recipient {
+        RecipientInput::Pkh(text) => text,
+        _ => condition.to_hash().to_b58(),
+    })
 }
 
-#[derive(Debug, Clone)]
-struct NoteSpec {
-    name_first: [u64; 5],
-    name_last: [u64; 5],
-    name_noun: Noun,
-    origin_page: u64,
-    assets: u64,
-    lock: Noun,
-    note_hash: [u64; 5],
-    witness_unsigned: Noun,
-    capacity: u64,
-    /// Signers whose slots seed the fee-estimation placeholder map: the source
-    /// pkh for single-sig, or the m expected signers for a multisig input.
-    signer_pkhs: Vec<[u64; 5]>,
+fn merge(a: &[u8], b: &[u8]) -> Result<Vec<u8>, String> {
+    let mut a = WalletTransaction::from_jam(a).map_err(|error| error.to_string())?;
+    let b = WalletTransaction::from_jam(b).map_err(|error| error.to_string())?;
+    if a.spends.map.wyt() != b.spends.map.wyt() {
+        return Err("transaction inputs differ".into());
+    }
+    let mut spends = ZMap::new();
+    let mut witnesses = ZMap::new();
+    for (name, mut spend) in a.spends.map.tap() {
+        let mut extra = b
+            .spends
+            .map
+            .get(&name)
+            .ok_or("transaction inputs differ")?
+            .clone();
+        let (SpendBody::V1(body), SpendBody::V1(extra_body)) = (&mut spend.body, &mut extra.body)
+        else {
+            return Err("merge requires V1 witness spends".into());
+        };
+        let sigs = core::mem::replace(&mut body.witness.pkh.map, ZMap::new());
+        let extra_sigs = core::mem::replace(&mut extra_body.witness.pkh.map, ZMap::new());
+        if body.to_jam().map_err(|error| error.to_string())?
+            != extra_body.to_jam().map_err(|error| error.to_string())?
+        {
+            return Err("transactions authorize different spends".into());
+        }
+        body.witness.pkh.map = sigs;
+        for (key, value) in extra_sigs.tap() {
+            if let Some(existing) = body.witness.pkh.map.get(&key) {
+                if existing.to_jam().map_err(|error| error.to_string())?
+                    != value.to_jam().map_err(|error| error.to_string())?
+                {
+                    return Err("conflicting signatures for the same key".into());
+                }
+            }
+            body.witness.pkh.map.put(key, value);
+        }
+        witnesses.put(name.clone(), body.witness.clone());
+        spends.put(name, spend);
+    }
+    a.spends = SpendsV1 { map: spends };
+    a.witnesses = witnesses;
+    a.name = tx_types::compute_tx_id_v1(&a.spends)
+        .map_err(|error| error.to_string())?
+        .to_b58();
+    a.to_jam().map_err(|error| error.to_string())
 }
 
-fn build_pkh_lock(arena: &mut Arena, pkh: [u64; 5]) -> Result<Noun, JsValue> {
-    build_pkh_lock_multisig(arena, 1, &[pkh])
+#[wasm_bindgen]
+pub fn merge_signed_tx(a: &[u8], b: &[u8]) -> Result<Vec<u8>, JsValue> {
+    merge(a, b).map_err(js_err)
 }
 
-fn build_pkh_lock_multisig(
-    arena: &mut Arena,
-    m_required: u64,
-    pkhs: &[[u64; 5]],
-) -> Result<Noun, JsValue> {
-    let header = arena.alloc_atom_bytes(b"pkh");
-    if m_required == 0 {
-        return Err(js_err("pkh lock requires m >= 1"));
-    }
-    if pkhs.is_empty() {
-        return Err(js_err("pkh lock requires at least 1 signer"));
-    }
-    if (m_required as usize) > pkhs.len() {
-        return Err(js_err("pkh lock requires m <= number of signers"));
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+    const A: &str = "9yPePjfWAdUnzaQKyxcRXKRa5PpUzKKEwtpECBZsUYt9Jd7egSDEWoV";
+    const B: &str = "9phXGACnW4238oqgvn2gpwaUjG3RAqcxq2Ash2vaKp8KjzSd3MQ56Jt";
+
+    fn input() -> ComposeTxV1Input {
+        let fixture: serde_json::Value = serde_json::from_str(include_str!(
+            "../../../../tests/fixtures/nockster-signed.json"
+        ))
+        .unwrap();
+        let note = &fixture["note"];
+        serde_json::from_value(json!({
+            "source_pkh": fixture["source"], "current_height": 60000,
+            "notes": [{"name_first": note["firstName"], "name_last": note["lastName"],
+                "origin_page": note["originPage"], "assets": 10000000, "note_data": note["noteData"]}],
+            "outputs": [{"recipient": A, "amount": 1000000}],
+        })).unwrap()
     }
-    let m = arena.alloc_atom_u64(m_required);
 
-    let mut set = arena.atom0();
-    for digest in pkhs {
-        let hash_noun = build_hash_noun(arena, *digest);
-        set = canonical_zset_put(arena, set, hash_noun)
-            .map_err(|e| js_err(format!("zset: {e:?}")))?;
+    #[test]
+    fn recipient_roots_match_official_wallet_vectors() {
+        assert_eq!(
+            recipient_condition(&RecipientInput::Pkh(A.into()))
+                .unwrap()
+                .to_hash()
+                .to_b58(),
+            "DKrgXqE8bXR1uBZ3t4vU13m2KquGCDbnn1PeoPL7dxSHTucGPFDPt53"
+        );
+        assert_eq!(
+            recipient_condition(&RecipientInput::Multisig {
+                m: 2,
+                pkhs: vec![B.into(), A.into()]
+            })
+            .unwrap()
+            .to_hash()
+            .to_b58(),
+            "4eMAT3BuhLPjYFronoYJ9RSLVSgveCL3nQB7RHSLZzjBTiYCxEzkzEH"
+        );
     }
 
-    let body = build_tuple(arena, &[m, set]);
-    Ok(build_tuple(arena, &[header, body]))
-}
-
-/// A `(unit @)`: `~` (atom 0) for None, `[~ v]` for Some.
-fn unit_opt(arena: &mut Arena, v: Option<u64>) -> Noun {
-    match v {
-        Some(n) => {
-            let z = arena.atom0();
-            let nn = arena.alloc_atom_u64(n);
-            build_tuple(arena, &[z, nn])
+    #[test]
+    fn drafts_bind_actual_note_data_and_estimate_fully_signed_fees() {
+        for height in [53999, 54000, 170000] {
+            let mut request = input();
+            request.current_height = Some(height);
+            let data =
+                tx_types::rpc_note_data::note_data_from_json(&request.notes[0].note_data).unwrap();
+            let note = NNoteV1 {
+                version: 1,
+                origin_page: PageNumber {
+                    value: request.notes[0].origin_page,
+                },
+                name: NName {
+                    p: vec![
+                        hash(&request.notes[0].name_first).unwrap(),
+                        hash(&request.notes[0].name_last).unwrap(),
+                    ],
+                },
+                assets: Coins {
+                    value: request.notes[0].assets,
+                },
+                note_data: data,
+            };
+            let result = compose(request, SelectionOrder::Descending).unwrap();
+            let raw = RawTransactionV1::from_jam(&result.raw_jam).unwrap();
+            let wallet = WalletTransaction::from_jam(&result.wallet_jam).unwrap();
+            assert_eq!(
+                raw.spends.to_jam().unwrap(),
+                wallet.spends.to_jam().unwrap()
+            );
+            assert_eq!(tx_types::compute_tx_id_v1(&raw.spends).unwrap(), raw.id);
+            assert_eq!(wallet.witnesses.wyt(), 1);
+            let SpendBody::V1(body) = &raw.spends.map.tap()[0].1.body else {
+                panic!()
+            };
+            assert!(body.witness.lmp.check(&note.name.p[0]));
+            assert_eq!(body.witness.pkh.map.wyt(), 0);
+            assert!(body
+                .seeds
+                .set
+                .tap()
+                .iter()
+                .all(|seed| seed.parent_hash == note.to_hash().unwrap()));
+            assert_eq!(
+                body.seeds
+                    .set
+                    .tap()
+                    .iter()
+                    .map(|seed| seed.gift.value)
+                    .sum::<u64>()
+                    + body.fee.value,
+                note.assets.value
+            );
+            let summary: serde_json::Value = serde_json::from_str(&result.summary_json).unwrap();
+            let words =
+                tx_types::word_count::transaction_words(&raw.spends.map, height >= 54000).unwrap();
+            assert_eq!(
+                summary["witness_words"].as_u64().unwrap(),
+                words.witness_words + 35
+            );
+            assert!(
+                summary["total_fees"].as_u64().unwrap() >= summary["minimum_fee"].as_u64().unwrap()
+            );
         }
-        None => arena.atom0(),
     }
-}
-
-/// `[%tim [rel=[min max] abs=[min max]]]` with each bound a `(unit page-number)`.
-fn build_tim_lock_full(
-    arena: &mut Arena,
-    rel_min: Option<u64>,
-    rel_max: Option<u64>,
-    abs_min: Option<u64>,
-    abs_max: Option<u64>,
-) -> Noun {
-    let header = arena.alloc_atom_bytes(b"tim");
-    let rmin = unit_opt(arena, rel_min);
-    let rmax = unit_opt(arena, rel_max);
-    let rel_range = build_tuple(arena, &[rmin, rmax]);
-    let amin = unit_opt(arena, abs_min);
-    let amax = unit_opt(arena, abs_max);
-    let abs_range = build_tuple(arena, &[amin, amax]);
-    let body = build_tuple(arena, &[rel_range, abs_range]);
-    build_tuple(arena, &[header, body])
-}
-
-fn build_tim_lock(arena: &mut Arena, rel_min: u64) -> Noun {
-    build_tim_lock_full(arena, Some(rel_min), None, None, None)
-}
 
-/// `[%hax (z-set hash)]` — commits to preimage hashes; the spender reveals the
-/// preimages in the witness hax map.
-fn build_hax_lock(arena: &mut Arena, commitments: &[[u64; 5]]) -> Result<Noun, JsValue> {
-    let header = arena.alloc_atom_bytes(b"hax");
-    let mut set = arena.atom0();
-    for c in commitments {
-        let hn = build_hash_noun(arena, *c);
-        set = canonical_zset_put(arena, set, hn).map_err(|e| js_err(format!("zset: {e:?}")))?;
-    }
-    Ok(build_tuple(arena, &[header, set]))
-}
-
-/// `[%brn ~]` — unspendable (burn).
-fn build_brn_lock(arena: &mut Arena) -> Noun {
-    let header = arena.alloc_atom_bytes(b"brn");
-    let null = arena.atom0();
-    build_tuple(arena, &[header, null])
-}
-
-fn build_note_data_with_lock(arena: &mut Arena, lock: Noun) -> Result<(Noun, u64), JsValue> {
-    let key_lock = arena.alloc_atom_bytes(b"lock");
-    let lock_data = build_tuple(arena, &[arena.atom0(), lock]);
-    let map = canonical_zmap_put(arena, arena.atom0(), key_lock, lock_data)
-        .map_err(|e| js_err(format!("zmap: {e:?}")))?;
-    Ok((map, 1))
-}
-
-fn compute_first_name_from_lock_hash(
-    lock_hash: [u64; 5],
-    ctx: &TxIdCtx,
-) -> Result<[u64; 5], JsValue> {
-    Ok(hash_ten_cell(ctx.null_digest, lock_hash).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-fn build_witness_unsigned(
-    arena: &mut Arena,
-    lock: Noun,
-    lock_hash: [u64; 5],
-    origin_page: u64,
-    bythos_phase: u64,
-) -> Noun {
-    let axis = arena.alloc_atom_u64(1);
-    let root = build_hash_noun(arena, lock_hash);
-    let path = arena.atom0();
-    let merkle_proof = build_tuple(arena, &[root, path]);
-    let lmp = if origin_page >= bythos_phase {
-        let version = arena.alloc_atom_bytes(LOCK_MERKLE_PROOF_FULL_TAG);
-        build_tuple(arena, &[version, lock, axis, merkle_proof])
-    } else {
-        build_tuple(arena, &[lock, axis, merkle_proof])
-    };
-
-    let pkh_map = arena.atom0();
-    let hax_map = arena.atom0();
-    let tim = arena.atom0();
-    build_tuple(arena, &[lmp, pkh_map, hax_map, tim])
-}
-
-fn placeholder_pkh_signature_value(arena: &mut Arena) -> Noun {
-    let zero6 = [
-        arena.alloc_atom_u64(0),
-        arena.alloc_atom_u64(0),
-        arena.alloc_atom_u64(0),
-        arena.alloc_atom_u64(0),
-        arena.alloc_atom_u64(0),
-        arena.alloc_atom_u64(0),
-    ];
-    let x = build_tuple(arena, &zero6);
-    let y = build_tuple(arena, &zero6);
-    let inf_false = arena.alloc_atom_u64(1);
-    let pk = build_tuple(arena, &[x, y, inf_false]);
-
-    let zero8 = [
-        arena.alloc_atom_u64(0),
-        arena.alloc_atom_u64(0),
-        arena.alloc_atom_u64(0),
-        arena.alloc_atom_u64(0),
-        arena.alloc_atom_u64(0),
-        arena.alloc_atom_u64(0),
-        arena.alloc_atom_u64(0),
-        arena.alloc_atom_u64(0),
-    ];
-    let chal = build_tuple(arena, &zero8);
-    let sig = build_tuple(arena, &zero8);
-    let schnorr_sig = build_tuple(arena, &[chal, sig]);
-    build_tuple(arena, &[pk, schnorr_sig])
-}
-
-/// One placeholder signature slot per signer, so fee estimation reflects the
-/// signed witness size (m slots for an m-of-n input) and every co-signer's
-/// device has a slot to fill.
-fn build_placeholder_pkh_map_multi(arena: &mut Arena, pkhs: &[[u64; 5]]) -> Result<Noun, JsValue> {
-    let mut map = arena.atom0();
-    for pkh in pkhs {
-        let key = build_hash_noun(arena, *pkh);
-        let value = placeholder_pkh_signature_value(arena);
-        map = canonical_zmap_put(arena, map, key, value)
-            .map_err(|e| js_err(format!("zmap: {e:?}")))?;
-    }
-    Ok(map)
-}
-
-fn witness_with_placeholder(
-    witness_unsigned: Noun,
-    placeholder_pkh_map: Noun,
-    arena: &mut Arena,
-) -> Result<Noun, JsValue> {
-    let (lmp, _pkh, hax, tim) =
-        tuple4(witness_unsigned, arena).ok_or_else(|| js_err("malformed witness"))?;
-    Ok(build_tuple(arena, &[lmp, placeholder_pkh_map, hax, tim]))
-}
-
-fn build_note_spec(
-    arena: &mut Arena,
-    note: &NoteInput,
-    source_pkh: [u64; 5],
-    source_multisig: Option<&(u64, Vec<[u64; 5]>)>,
-    source_or_lock: Option<&OrSourceInput>,
-    ctx: &TxIdCtx,
-    coinbase_rel_min: u64,
-    bythos_phase: u64,
-) -> Result<NoteSpec, JsValue> {
-    let name_first = parse_b58_hash(&note.name_first)?;
-    let name_last = parse_b58_hash(&note.name_last)?;
-    let first_noun = build_hash_noun(arena, name_first);
-    let last_noun = build_hash_noun(arena, name_last);
-    let name_noun = build_tuple(arena, &[first_noun, last_noun, arena.atom0()]);
-
-    // Reconstruct the note lock by matching its first name. An OR-composed
-    // source spends one branch (custom full-lmp witness); a multisig source is
-    // the m-of-n pkh lock; otherwise try a simple pkh then a coinbase lock.
-    let (lock, lock_hash, signer_pkhs, witness_override) = if let Some(or) = source_or_lock {
-        let (lock, root, witness, signers) =
-            build_or_input(arena, &or.branches, or.spend_branch as usize, ctx)?;
-        if compute_first_name_from_lock_hash(root, ctx)? != name_first {
-            return Err(js_err("note name does not match the provided OR lock / branches"));
-        }
-        (lock, root, signers, Some(witness))
-    } else if let Some((m, pkhs)) = source_multisig {
-        let ms_lock = build_pkh_lock_multisig(arena, *m, pkhs)?;
-        let ms_list = build_list(arena, &[ms_lock]);
-        let ms_hash = hash_lock_primitives_list(ms_list, arena, ctx)?;
-        if compute_first_name_from_lock_hash(ms_hash, ctx)? != name_first {
-            return Err(js_err(
-                "note name does not match the provided multisig lock (m/signers)",
-            ));
-        }
-        let signers: Vec<[u64; 5]> = pkhs.iter().take(*m as usize).copied().collect();
-        (ms_list, ms_hash, signers, None)
-    } else {
-        let simple_pkh = build_pkh_lock(arena, source_pkh)?;
-        let simple_lock = build_list(arena, &[simple_pkh]);
-        let simple_lock_hash = hash_lock_primitives_list(simple_lock, arena, ctx)?;
-        let simple_first = compute_first_name_from_lock_hash(simple_lock_hash, ctx)?;
-        let (lock, lock_hash) = if simple_first == name_first {
-            (simple_lock, simple_lock_hash)
-        } else {
-            let coinbase_pkh = build_pkh_lock(arena, source_pkh)?;
-            let coinbase_tim = build_tim_lock(arena, coinbase_rel_min);
-            let coinbase_lock = build_list(arena, &[coinbase_pkh, coinbase_tim]);
-            let coinbase_hash = hash_lock_primitives_list(coinbase_lock, arena, ctx)?;
-            let coinbase_first = compute_first_name_from_lock_hash(coinbase_hash, ctx)?;
-            if coinbase_first == name_first {
-                (coinbase_lock, coinbase_hash)
-            } else {
-                return Err(js_err(
-                    "unsupported note lock; provide a standard pkh or coinbase note",
-                ));
-            }
-        };
-        (lock, lock_hash, vec![source_pkh], None)
-    };
-
-    let (note_data, _) = build_note_data_with_lock(arena, lock)?;
-    let note_data_hash = hash_note_data(note_data, arena)?;
-    let name_hash = hash_nname_hashable(name_noun, arena)?;
-
-    let version_noun = arena.alloc_atom_u64(note.version);
-    let origin_noun = arena.alloc_atom_u64(note.origin_page);
-    let assets_noun = arena.alloc_atom_u64(note.assets);
-    let version_digest =
-        hash_noun_varlen(version_noun, arena).map_err(|e| js_err(format!("{e:?}")))?;
-    let origin_digest =
-        hash_noun_varlen(origin_noun, arena).map_err(|e| js_err(format!("{e:?}")))?;
-    let assets_digest =
-        hash_noun_varlen(assets_noun, arena).map_err(|e| js_err(format!("{e:?}")))?;
-
-    let mut note_hash = assets_digest;
-    note_hash = hash_ten_cell(note_data_hash, note_hash).map_err(|e| js_err(format!("{e:?}")))?;
-    note_hash = hash_ten_cell(name_hash, note_hash).map_err(|e| js_err(format!("{e:?}")))?;
-    note_hash = hash_ten_cell(origin_digest, note_hash).map_err(|e| js_err(format!("{e:?}")))?;
-    note_hash = hash_ten_cell(version_digest, note_hash).map_err(|e| js_err(format!("{e:?}")))?;
-
-    let witness_unsigned = match witness_override {
-        Some(w) => w,
-        None => build_witness_unsigned(arena, lock, lock_hash, note.origin_page, bythos_phase),
-    };
-    Ok(NoteSpec {
-        name_first,
-        name_last,
-        name_noun,
-        origin_page: note.origin_page,
-        assets: note.assets,
-        lock,
-        note_hash,
-        witness_unsigned,
-        capacity: note.assets,
-        signer_pkhs,
-    })
-}
-
-/// Build one spend-condition (AND-list of primitives) and a display string.
-/// `[%brn]` if `burn`, else `[pkh, (tim)?, (hax)?]`.
-fn build_spend_condition(
-    arena: &mut Arena,
-    recipient: Option<&RecipientInput>,
-    timelock: Option<&TimelockSpec>,
-    hashlock: Option<&[String]>,
-    burn: bool,
-    ctx: &TxIdCtx,
-) -> Result<(Noun, Option<String>), JsValue> {
-    if burn {
-        let brn = build_brn_lock(arena);
-        return Ok((build_list(arena, &[brn]), None));
-    }
-    let recipient = recipient.ok_or_else(|| js_err("spend-condition needs a recipient or burn"))?;
-    let (pkh, recipient_b58) = recipient_lock_and_display_address(arena, recipient, ctx)?;
-    let mut prims = vec![pkh];
-    if let Some(tl) = timelock {
-        if tl.rel_min.is_none()
-            && tl.rel_max.is_none()
-            && tl.abs_min.is_none()
-            && tl.abs_max.is_none()
-        {
-            return Err(js_err("timelock requires at least one bound"));
-        }
-        prims.push(build_tim_lock_full(
-            arena, tl.rel_min, tl.rel_max, tl.abs_min, tl.abs_max,
-        ));
-    }
-    if let Some(hashes) = hashlock {
-        if hashes.is_empty() {
-            return Err(js_err("hashlock requires at least one commitment"));
-        }
-        let mut digests: Vec<[u64; 5]> = Vec::with_capacity(hashes.len());
-        for h in hashes {
-            digests.push(parse_b58_hash(h)?);
-        }
-        digests.sort();
-        digests.dedup();
-        prims.push(build_hax_lock(arena, &digests)?);
-    }
-    Ok((build_list(arena, &prims), Some(recipient_b58)))
-}
-
-fn build_output_seed_spec(
-    arena: &mut Arena,
-    output: &OutputInput,
-    ctx: &TxIdCtx,
-) -> Result<SeedSpec, JsValue> {
-    // OR-composed lock (any branch can spend), else a single spend-condition.
-    let (lock, lock_hash, recipient_b58) = if let Some(branches) = &output.or_branches {
-        let (lock, root) = build_or_lock(arena, branches, ctx)?;
-        (lock, root, hash_to_b58(root))
-    } else {
-        let (sc, display) = build_spend_condition(
-            arena,
-            Some(&output.recipient),
-            output.timelock.as_ref(),
-            output.hashlock.as_deref(),
-            output.burn,
-            ctx,
-        )?;
-        let hash = hash_lock_primitives_list(sc, arena, ctx)?;
-        let display = display.unwrap_or_else(|| hash_to_b58(hash));
-        (sc, hash, display)
-    };
-    // Semi-anonymous: commit only the lock-root (empty note_data); else embed
-    // the full lock so the recipient/chain can see it.
-    let note_data = if output.lock_root_only {
-        arena.atom0()
-    } else {
-        build_note_data_with_lock(arena, lock)?.0
-    };
-    Ok(SeedSpec {
-        lock_root: lock_hash,
-        note_data,
-        gift: output.amount,
-        recipient_b58,
-    })
-}
-
-/// Build an OR-composed lock from branch spend-conditions, mirroring
-/// nockchain `++lock`: pad to the nearest power of two (≤16) with `[%brn]`
-/// fillers, build the balanced `%2/%4/%8/%16` tree, and hash it
-/// (`hash-leaf(size) :: balanced-hash-pair(leaf-hashes)`).
-///
-/// Validated against nockchain's golden `%2`/`%4` lock-root vectors
-/// (`or_composed_lock_roots_match_nockchain_vectors`).
-fn build_or_lock(
-    arena: &mut Arena,
-    branches: &[LockBranch],
-    ctx: &TxIdCtx,
-) -> Result<(Noun, [u64; 5]), JsValue> {
-    if branches.is_empty() {
-        return Err(js_err("OR lock requires at least one branch"));
-    }
-    let mut scs: Vec<Noun> = Vec::with_capacity(branches.len());
-    for b in branches {
-        let (sc, _display) = build_spend_condition(
-            arena,
-            b.recipient.as_ref(),
-            b.timelock.as_ref(),
-            b.hashlock.as_deref(),
-            b.burn,
-            ctx,
-        )?;
-        scs.push(sc);
-    }
-    // nearest power of two >= len, capped at 16.
-    let len = scs.len();
-    let mut size = 1usize;
-    while size < len {
-        size <<= 1;
-    }
-    if size > 16 {
-        return Err(js_err("OR lock supports at most 16 branches"));
-    }
-    // Pad with `[%brn]` filler spend-conditions.
-    while scs.len() < size {
-        let brn = build_brn_lock(arena);
-        scs.push(build_list(arena, &[brn]));
-    }
-    let leaf_hashes: Vec<[u64; 5]> = scs
-        .iter()
-        .map(|sc| hash_lock_primitives_list(*sc, arena, ctx))
-        .collect::<Result<_, _>>()?;
-    let lock = build_lock_tree_noun(arena, &scs, size);
-    let root = hash_lock_tree_root(arena, &leaf_hashes, size)?;
-    Ok((lock, root))
-}
-
-/// The pkh signer hashes a branch needs (for fee/placeholder sizing).
-fn branch_signer_pkhs(branch: &LockBranch) -> Result<Vec<[u64; 5]>, JsValue> {
-    if branch.burn {
-        return Ok(Vec::new());
-    }
-    match &branch.recipient {
-        Some(RecipientInput::Pkh(b58)) => Ok(vec![parse_b58_hash(b58)?]),
-        Some(RecipientInput::Multisig { m, pkhs }) => {
-            let mut digests: Vec<[u64; 5]> = Vec::new();
-            for p in pkhs {
-                digests.push(parse_b58_hash(p)?);
-            }
-            digests.sort();
-            digests.dedup();
-            Ok(digests.into_iter().take(*m as usize).collect())
-        }
-        None => Ok(Vec::new()),
-    }
-}
-
-/// Reconstruct an OR-composed input lock and build the unsigned witness that
-/// spends it via the chosen branch — a full lock-merkle-proof
-/// (`[%full spend-condition axis [root path]]`) plus placeholder signature
-/// slots for that branch's signers. Returns (lock, lock_root, witness, signers).
-fn build_or_input(
-    arena: &mut Arena,
-    branches: &[LockBranch],
-    spend_branch: usize,
-    ctx: &TxIdCtx,
-) -> Result<(Noun, [u64; 5], Noun, Vec<[u64; 5]>), JsValue> {
-    if branches.is_empty() {
-        return Err(js_err("OR input requires at least one branch"));
-    }
-    if spend_branch >= branches.len() {
-        return Err(js_err("spend_branch out of range"));
-    }
-    let mut scs: Vec<Noun> = Vec::new();
-    let mut signers: Vec<Vec<[u64; 5]>> = Vec::new();
-    for b in branches {
-        let (sc, _disp) = build_spend_condition(
-            arena,
-            b.recipient.as_ref(),
-            b.timelock.as_ref(),
-            b.hashlock.as_deref(),
-            b.burn,
-            ctx,
-        )?;
-        scs.push(sc);
-        signers.push(branch_signer_pkhs(b)?);
-    }
-    let mut size = 1usize;
-    while size < scs.len() {
-        size <<= 1;
-    }
-    if size > 16 {
-        return Err(js_err("OR input supports at most 16 branches"));
-    }
-    while scs.len() < size {
-        let brn = build_brn_lock(arena);
-        scs.push(build_list(arena, &[brn]));
-        signers.push(Vec::new());
-    }
-    let leaf_hashes: Vec<[u64; 5]> = scs
-        .iter()
-        .map(|sc| hash_lock_primitives_list(*sc, arena, ctx))
-        .collect::<Result<_, _>>()?;
-    let lock = build_lock_tree_noun(arena, &scs, size);
-    let root = hash_lock_tree_root(arena, &leaf_hashes, size)?;
-
-    // Prove the chosen leaf. leaf_number is 1-indexed (spend_branch + 1) and
-    // the hashable index adds 1 more because the tag occupies hashable leaf 1.
-    let tree = or_hashable_tree(arena, &leaf_hashes, size);
-    let (proof_root, path, axis) = htree_prove(&tree, spend_branch as u64 + 2)?;
-    if proof_root != root {
-        return Err(js_err("internal: OR proof root mismatch"));
-    }
-
-    // Full lock-merkle-proof witness for the chosen branch.
-    let version = arena.alloc_atom_bytes(LOCK_MERKLE_PROOF_FULL_TAG);
-    let chosen_sc = scs[spend_branch];
-    let axis_noun = arena.alloc_atom_u64(axis);
-    let root_noun = build_hash_noun(arena, root);
-    let path_nouns: Vec<Noun> = path.iter().map(|h| build_hash_noun(arena, *h)).collect();
-    let path_noun = if path_nouns.is_empty() {
-        arena.atom0()
-    } else {
-        build_list(arena, &path_nouns)
-    };
-    let merkle_proof = build_tuple(arena, &[root_noun, path_noun]);
-    let lmp = build_tuple(arena, &[version, chosen_sc, axis_noun, merkle_proof]);
-    let pkh_map = build_placeholder_pkh_map_multi(arena, &signers[spend_branch])?;
-    let hax = arena.atom0();
-    let tim = arena.atom0();
-    let witness = build_tuple(arena, &[lmp, pkh_map, hax, tim]);
-    Ok((lock, root, witness, signers[spend_branch].clone()))
-}
-
-/// Tree noun per nockchain `++build`: leaf is the spend-condition; `%2` keeps
-/// both children whole; higher tags re-tag the stripped child payloads.
-fn build_lock_tree_noun(arena: &mut Arena, leaves: &[Noun], size: usize) -> Noun {
-    if size == 1 {
-        return leaves[0];
-    }
-    let half = size / 2;
-    let left = build_lock_tree_noun(arena, &leaves[..half], half);
-    let right = build_lock_tree_noun(arena, &leaves[half..], half);
-    let tag = arena.alloc_atom_u64(size as u64);
-    if size == 2 {
-        build_tuple(arena, &[tag, left, right])
-    } else {
-        // `[%size +.left +.right]`: strip the child tags (take their tails).
-        let lp = match left {
-            Noun::Cell(id) => arena.cell(id).tail,
-            _ => left,
-        };
-        let rp = match right {
-            Noun::Cell(id) => arena.cell(id).tail,
-            _ => right,
-        };
-        build_tuple(arena, &[tag, lp, rp])
-    }
-}
-
-/// Lock-root per nockchain `Lock::hash`: a single leaf hashes to its
-/// spend-condition hash; a tree hashes to `hash-pair(leaf(size),
-/// balanced-hash-pair(leaf-hashes))`.
-fn hash_lock_tree_root(
-    arena: &mut Arena,
-    leaf_hashes: &[[u64; 5]],
-    size: usize,
-) -> Result<[u64; 5], JsValue> {
-    if size == 1 {
-        return Ok(leaf_hashes[0]);
-    }
-    let tag_atom = arena.alloc_atom_u64(size as u64);
-    let tag_digest = hash_noun_varlen(tag_atom, arena).map_err(|e| js_err(format!("{e:?}")))?;
-    let payload = hash_balanced_pairs(leaf_hashes)?;
-    Ok(hash_ten_cell(tag_digest, payload).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-fn hash_balanced_pairs(hashes: &[[u64; 5]]) -> Result<[u64; 5], JsValue> {
-    if hashes.len() == 1 {
-        return Ok(hashes[0]);
-    }
-    let half = hashes.len() / 2;
-    let left = hash_balanced_pairs(&hashes[..half])?;
-    let right = hash_balanced_pairs(&hashes[half..])?;
-    Ok(hash_ten_cell(left, right).map_err(|e| js_err(format!("{e:?}")))?)
-}
-
-#[wasm_bindgen]
-pub fn compose_tx_v1_recipient_address(recipient: JsValue) -> Result<String, JsValue> {
-    let recipient: RecipientInput = serde_wasm_bindgen::from_value(recipient)
-        .map_err(|e| js_err(format!("bad recipient: {e}")))?;
-
-    match recipient {
-        RecipientInput::Pkh(b58) => Ok(b58),
-        recipient @ RecipientInput::Multisig { .. } => {
-            let mut arena = Arena::new();
-            let ctx = tx_id_ctx(&mut arena)?;
-
-            let (_lock, addr) = recipient_lock_and_display_address(&mut arena, &recipient, &ctx)?;
-            Ok(addr)
-        }
-    }
-}
-
-fn split_seeds_to_capacity(
-    mut seeds: Vec<SeedSpec>,
-    capacity: u64,
-) -> Result<Vec<SeedSpec>, JsValue> {
-    let mut processed = Vec::new();
-
-    for seed in seeds.drain(..) {
-        if seed.gift <= capacity {
-            processed.push(seed);
-            continue;
-        }
-
-        let mut remaining = seed.gift;
-        while remaining > 0 {
-            let chunk_amount = remaining.min(capacity);
-            if chunk_amount == 0 {
-                return Err(js_err("cannot split seed to zero-capacity note"));
-            }
-
-            processed.push(SeedSpec {
-                gift: chunk_amount,
-                ..seed.clone()
-            });
-            remaining = remaining.saturating_sub(chunk_amount);
-        }
-    }
-
-    Ok(processed)
-}
-
-fn consolidate_seeds(seeds: Vec<SeedSpec>, arena: &Arena) -> Vec<SeedSpec> {
-    let mut out: Vec<SeedSpec> = Vec::new();
-    'outer: for seed in seeds {
-        for existing in out.iter_mut() {
-            if existing.lock_root == seed.lock_root
-                && nouns_equal(existing.note_data, seed.note_data, arena)
-            {
-                existing.gift = existing.gift.saturating_add(seed.gift);
-                continue 'outer;
-            }
-        }
-        out.push(seed);
-    }
-    out
-}
-
-fn build_seed_noun(arena: &mut Arena, seed: &SeedSpec, parent_hash: [u64; 5]) -> Noun {
-    let output_source = arena.atom0();
-    let lock_root = build_hash_noun(arena, seed.lock_root);
-    let gift = arena.alloc_atom_u64(seed.gift);
-    let parent_hash = build_hash_noun(arena, parent_hash);
-    build_tuple(
-        arena,
-        &[output_source, lock_root, seed.note_data, gift, parent_hash],
-    )
-}
-
-#[derive(Debug, Clone)]
-struct SpendPlan {
-    note_index: usize,
-    accepted: Vec<SeedSpec>,
-    refund_gift: u64,
-    fee: u64,
-}
-
-#[derive(Debug)]
-struct CandidatePlan {
-    plans: Vec<SpendPlan>,
-    fee_breakdown: FeeBreakdown,
-    selected_assets: u64,
-}
-
-#[derive(Debug)]
-struct BuiltSpend {
-    spend: Noun,
-    witness: Noun,
-}
-
-fn build_spend_from_plan(
-    arena: &mut Arena,
-    note: &NoteSpec,
-    plan: &SpendPlan,
-    witness: Noun,
-    refund_lock_root: [u64; 5],
-    refund_note_data: Noun,
-    refund_recipient_b58: &str,
-) -> Result<BuiltSpend, JsValue> {
-    let mut accepted = plan.accepted.clone();
-
-    if plan.refund_gift > 0 {
-        let refund_seed = SeedSpec {
-            lock_root: refund_lock_root,
-            note_data: refund_note_data,
-            gift: plan.refund_gift,
-            recipient_b58: refund_recipient_b58.to_string(),
-        };
-        accepted.push(refund_seed);
-    }
-
-    if accepted.is_empty() {
-        return Err(js_err("spend would have no output seeds"));
-    }
-
-    let mut tally = note
-        .assets
-        .checked_sub(plan.fee)
-        .ok_or_else(|| js_err("fee tally underflow"))?;
-    for seed in &accepted {
-        tally = tally
-            .checked_sub(seed.gift)
-            .ok_or_else(|| js_err("input/output mismatch: gifts exceed assets"))?;
-    }
-    if tally != 0 {
-        return Err(js_err("input/output mismatch: does not tally"));
-    }
-
-    let consolidated = consolidate_seeds(accepted, arena);
-
-    let mut seed_set = arena.atom0();
-    for seed in consolidated.iter() {
-        let seed_noun = build_seed_noun(arena, seed, note.note_hash);
-        seed_set = canonical_zset_put(arena, seed_set, seed_noun)
-            .map_err(|e| js_err(format!("zset: {e:?}")))?;
-    }
-
-    let fee_noun = arena.alloc_atom_u64(plan.fee);
-    let spend_body = build_tuple(arena, &[witness, seed_set, fee_noun]);
-    let spend_version = arena.alloc_atom_u64(1);
-    let spend = build_tuple(arena, &[spend_version, spend_body]);
-
-    Ok(BuiltSpend { spend, witness })
-}
-
-fn build_initial_plans_for_order(
-    notes: &[NoteSpec],
-    note_order: &[usize],
-    seeds: &[SeedSpec],
-) -> Result<Option<Vec<SpendPlan>>, JsValue> {
-    if note_order.is_empty() {
-        return Ok(None);
-    }
-
-    let max_capacity = note_order
-        .iter()
-        .filter_map(|idx| notes.get(*idx).map(|note| note.capacity))
-        .max()
-        .unwrap_or(0);
-    if max_capacity == 0 {
-        return Ok(None);
-    }
-
-    let mut remaining_seeds = split_seeds_to_capacity(seeds.to_vec(), max_capacity)?;
-    remaining_seeds.sort_by(|a, b| b.gift.cmp(&a.gift));
-    let mut plans = Vec::<SpendPlan>::new();
-
-    for note_index in note_order {
-        if remaining_seeds.is_empty() {
-            break;
-        }
-        let Some(note) = notes.get(*note_index) else {
-            return Ok(None);
-        };
-        remaining_seeds = split_seeds_to_capacity(remaining_seeds, note.capacity)?;
-        remaining_seeds.sort_by(|a, b| b.gift.cmp(&a.gift));
-
-        let mut accepted = Vec::new();
-        let mut leftover = Vec::new();
-        let mut remaining_assets = note.assets;
-        for seed in remaining_seeds {
-            if remaining_assets >= seed.gift {
-                remaining_assets -= seed.gift;
-                accepted.push(seed);
-            } else {
-                leftover.push(seed);
-            }
-        }
-        remaining_seeds = leftover;
-        plans.push(SpendPlan {
-            note_index: *note_index,
-            accepted,
-            refund_gift: remaining_assets,
-            fee: 0,
-        });
-    }
-
-    if remaining_seeds.is_empty() {
-        Ok(Some(plans))
-    } else {
-        Ok(None)
-    }
-}
-
-fn settle_candidate_fees(
-    arena: &mut Arena,
-    notes: &[NoteSpec],
-    mut plans: Vec<SpendPlan>,
-    // Retained for signature symmetry; per-note signers now size the fee
-    // placeholder map (see build_candidate_plan), so this is unused.
-    _source_pkh: [u64; 5],
-    refund_lock_root: [u64; 5],
-    refund_note_data: Noun,
-    refund_recipient_b58: &str,
-    current_height: u64,
-    fee_policy: FeePolicy,
-) -> Result<Option<CandidatePlan>, JsValue> {
-    if plans.is_empty() {
-        return Ok(None);
-    }
-
-    let mut fee_spends_map = arena.atom0();
-    for plan in &plans {
-        let note = &notes[plan.note_index];
-        let placeholder_map = build_placeholder_pkh_map_multi(arena, &note.signer_pkhs)?;
-        let fee_witness = witness_with_placeholder(note.witness_unsigned, placeholder_map, arena)?;
-        let built = build_spend_from_plan(
-            arena,
-            note,
-            plan,
-            fee_witness,
-            refund_lock_root,
-            refund_note_data,
-            refund_recipient_b58,
-        )?;
-        fee_spends_map = canonical_zmap_put(arena, fee_spends_map, note.name_noun, built.spend)
-            .map_err(|e| js_err(format!("zmap: {e:?}")))?;
-    }
-
-    let fee_breakdown =
-        calculate_transaction_fee(arena, fee_spends_map, current_height, fee_policy)?;
-    let fee_capacity = plans
-        .iter()
-        .map(|plan| {
-            if plan.accepted.is_empty() {
-                plan.refund_gift.saturating_sub(1)
-            } else {
-                plan.refund_gift
-            }
-        })
-        .sum::<u64>();
-    if fee_capacity < fee_breakdown.minimum_fee {
-        return Ok(None);
-    }
-
-    let mut remaining_fee = fee_breakdown.minimum_fee;
-    for plan in plans.iter_mut().rev() {
-        if remaining_fee == 0 {
-            plan.fee = 0;
-            continue;
-        }
-        let available = if plan.accepted.is_empty() {
-            plan.refund_gift.saturating_sub(1)
-        } else {
-            plan.refund_gift
-        };
-        let take = available.min(remaining_fee);
-        plan.refund_gift -= take;
-        plan.fee = take;
-        remaining_fee -= take;
-    }
-    debug_assert_eq!(remaining_fee, 0);
-
-    let selected_assets = plans
-        .iter()
-        .map(|plan| notes[plan.note_index].assets)
-        .sum::<u64>();
-    Ok(Some(CandidatePlan {
-        plans,
-        fee_breakdown,
-        selected_assets,
-    }))
-}
-
-// Consume the largest notes first and stop as soon as outputs and their actual
-// serialized fee fit. Seed fragments fill each input without subset enumeration.
-fn choose_largest_first_plan(
-    arena: &mut Arena,
-    notes: &[NoteSpec],
-    seeds: &[SeedSpec],
-    source_pkh: [u64; 5],
-    refund_lock_root: [u64; 5],
-    refund_note_data: Noun,
-    refund_recipient_b58: &str,
-    current_height: u64,
-    fee_policy: FeePolicy,
-) -> Result<CandidatePlan, JsValue> {
-    let mut order: Vec<usize> = (0..notes.len()).collect();
-    order.sort_by(|a, b| {
-        notes[*b]
-            .assets
-            .cmp(&notes[*a].assets)
-            .then_with(|| notes[*a].origin_page.cmp(&notes[*b].origin_page))
-            .then_with(|| notes[*a].name_last.cmp(&notes[*b].name_last))
-    });
-    let mut remaining: std::collections::VecDeque<SeedSpec> = seeds.to_vec().into();
-    let mut plans = Vec::new();
-    for note_index in order {
-        let mut available = notes[note_index].assets;
-        let mut accepted = Vec::new();
-        while available > 0 {
-            let Some(seed) = remaining.front_mut() else {
-                break;
-            };
-            let gift = seed.gift.min(available);
-            accepted.push(SeedSpec {
-                gift,
-                ..seed.clone()
-            });
-            available -= gift;
-            seed.gift -= gift;
-            if seed.gift == 0 {
-                remaining.pop_front();
-            }
-        }
-        plans.push(SpendPlan {
-            note_index,
-            accepted,
-            refund_gift: available,
-            fee: 0,
-        });
-        if remaining.is_empty() && plans.iter().any(|plan| plan.refund_gift > 0) {
-            if let Some(candidate) = settle_candidate_fees(
-                arena,
-                notes,
-                plans.clone(),
-                source_pkh,
-                refund_lock_root,
-                refund_note_data,
-                refund_recipient_b58,
-                current_height,
-                fee_policy,
-            )? {
-                return Ok(candidate);
-            }
-        }
-    }
-    Err(js_err(
-        "insufficient funds to cover requested outputs and fee",
-    ))
-}
-
-fn candidate_better(candidate: &CandidatePlan, best: Option<&CandidatePlan>) -> bool {
-    let Some(best) = best else {
-        return true;
-    };
-    candidate
-        .fee_breakdown
-        .minimum_fee
-        .cmp(&best.fee_breakdown.minimum_fee)
-        .then_with(|| candidate.plans.len().cmp(&best.plans.len()))
-        .then_with(|| candidate.selected_assets.cmp(&best.selected_assets))
-        == core::cmp::Ordering::Less
-}
-
-fn push_candidate_order(orders: &mut Vec<Vec<usize>>, order: Vec<usize>) {
-    if order.is_empty() {
-        return;
-    }
-    if orders.iter().any(|existing| existing == &order) {
-        return;
-    }
-    orders.push(order);
-}
-
-fn collect_combinations_for_count(
-    sorted_indices: &[usize],
-    notes: &[NoteSpec],
-    target: u64,
-    count: usize,
-    start: usize,
-    current: &mut Vec<usize>,
-    current_sum: u64,
-    out: &mut Vec<Vec<usize>>,
-    limit: usize,
-) {
-    if out.len() >= limit {
-        return;
-    }
-    if current.len() == count {
-        if current_sum >= target {
-            out.push(current.clone());
-        }
-        return;
-    }
-
-    let remaining_needed = count.saturating_sub(current.len());
-    if sorted_indices.len().saturating_sub(start) < remaining_needed {
-        return;
-    }
-
-    for pos in start..sorted_indices.len() {
-        if out.len() >= limit {
-            return;
-        }
-        let idx = sorted_indices[pos];
-        current.push(idx);
-        collect_combinations_for_count(
-            sorted_indices,
-            notes,
-            target,
-            count,
-            pos + 1,
-            current,
-            current_sum.saturating_add(notes[idx].assets),
-            out,
-            limit,
-        );
-        current.pop();
-    }
-}
-
-fn candidate_note_orders(
-    notes: &[NoteSpec],
-    target: u64,
-    fee_policy: FeePolicy,
-) -> Vec<Vec<usize>> {
-    const MAX_COMBINATION_COUNT: usize = 6;
-    const MAX_COMBINATIONS_PER_COUNT: usize = 160;
-
-    let mut asc: Vec<usize> = (0..notes.len()).collect();
-    asc.sort_by(|a, b| {
-        notes[*a]
-            .assets
-            .cmp(&notes[*b].assets)
-            .then_with(|| notes[*a].origin_page.cmp(&notes[*b].origin_page))
-    });
-    let mut desc = asc.clone();
-    desc.reverse();
-
-    let mut orders = Vec::<Vec<usize>>::new();
-    for idx in &asc {
-        push_candidate_order(&mut orders, vec![*idx]);
-    }
-
-    let mut sum = 0u64;
-    let mut order = Vec::new();
-    for idx in &asc {
-        order.push(*idx);
-        sum = sum.saturating_add(notes[*idx].assets);
-        if sum >= target {
-            push_candidate_order(&mut orders, order.clone());
-        }
-    }
-
-    sum = 0;
-    order.clear();
-    for idx in &desc {
-        order.push(*idx);
-        sum = sum.saturating_add(notes[*idx].assets);
-        if sum >= target {
-            push_candidate_order(&mut orders, order.clone());
-            break;
-        }
-    }
-
-    let combination_target = target.saturating_add(fee_policy.min_fee);
-    let max_count = notes.len().min(MAX_COMBINATION_COUNT);
-    for count in 2..=max_count {
-        let mut combos = Vec::new();
-        collect_combinations_for_count(
-            &asc,
-            notes,
-            combination_target,
-            count,
-            0,
-            &mut Vec::new(),
-            0,
-            &mut combos,
-            MAX_COMBINATIONS_PER_COUNT,
-        );
-        for combo in combos {
-            let mut by_large = combo.clone();
-            by_large.sort_by(|a, b| {
-                notes[*b]
-                    .capacity
-                    .cmp(&notes[*a].capacity)
-                    .then_with(|| notes[*a].origin_page.cmp(&notes[*b].origin_page))
-            });
-            push_candidate_order(&mut orders, by_large);
-
-            let mut by_small = combo;
-            by_small.sort_by(|a, b| {
-                notes[*a]
-                    .assets
-                    .cmp(&notes[*b].assets)
-                    .then_with(|| notes[*a].origin_page.cmp(&notes[*b].origin_page))
-            });
-            push_candidate_order(&mut orders, by_small);
-        }
-    }
-
-    push_candidate_order(&mut orders, desc);
-    orders
-}
-
-fn choose_best_candidate_plan(
-    arena: &mut Arena,
-    notes: &[NoteSpec],
-    seeds: &[SeedSpec],
-    output_total: u64,
-    source_pkh: [u64; 5],
-    refund_lock_root: [u64; 5],
-    refund_note_data: Noun,
-    refund_recipient_b58: &str,
-    current_height: u64,
-    fee_policy: FeePolicy,
-) -> Result<CandidatePlan, JsValue> {
-    let mut best: Option<CandidatePlan> = None;
-    for order in candidate_note_orders(notes, output_total, fee_policy) {
-        let Some(plans) = build_initial_plans_for_order(notes, &order, seeds)? else {
-            continue;
-        };
-        let Some(candidate) = settle_candidate_fees(
-            arena,
-            notes,
-            plans,
-            source_pkh,
-            refund_lock_root,
-            refund_note_data,
-            refund_recipient_b58,
-            current_height,
-            fee_policy,
-        )?
-        else {
-            continue;
-        };
-
-        if candidate_better(&candidate, best.as_ref()) {
-            best = Some(candidate);
-        }
-    }
-
-    best.ok_or_else(|| js_err("insufficient funds to cover requested outputs and fee"))
-}
-
-// ---- lock-merkle-proof (spending from an OR-composed lock) ----------------
-//
-// Mirrors nockchain `++prove-hashable-by-index` / `++verify-merk-proof`
-// (hoon/common/ztd/three.hoon). The hashable of an OR lock is
-// `[leaf+tag, balanced-payload]`; a leaf's `axis` is its Nock tree address and
-// the `path` is the sibling digests leaf→root.
-
-/// Abstract hashable tree node used for proof construction.
-enum HTree {
-    Leaf([u64; 5]),
-    Node(Box<HTree>, Box<HTree>),
-}
-
-fn htree_node_digest(t: &HTree) -> [u64; 5] {
-    match t {
-        HTree::Leaf(d) => *d,
-        HTree::Node(p, q) => {
-            hash_ten_cell(htree_node_digest(p), htree_node_digest(q)).unwrap_or([0; 5])
-        }
-    }
-}
-
-fn htree_leaf_count(t: &HTree) -> u64 {
-    match t {
-        HTree::Leaf(_) => 1,
-        HTree::Node(p, q) => htree_leaf_count(p) + htree_leaf_count(q),
-    }
-}
-
-/// Hoon `++peg`: replace the leading 1 of `b` with `a` (a → high bits).
-fn peg(a: u64, b: u64) -> u64 {
-    if b == 1 {
-        return a;
-    }
-    let d = (64 - b.leading_zeros() as u64) - 1; // dec(xeb(b))
-    (a << d) + (b - (1u64 << d))
-}
-
-/// `++go`: returns (root, path, axis) for the 1-indexed leaf `i`.
-fn htree_prove(t: &HTree, i: u64) -> Result<([u64; 5], Vec<[u64; 5]>, u64), JsValue> {
-    match t {
-        HTree::Leaf(d) => Ok((*d, Vec::new(), 1)),
-        HTree::Node(p, q) => {
-            let lc = htree_leaf_count(p);
-            if i <= lc {
-                let (root, mut path, axis) = htree_prove(p, i)?;
-                let sib = htree_node_digest(q);
-                let new_root = hash_ten_cell(root, sib).map_err(|e| js_err(format!("{e:?}")))?;
-                path.push(sib);
-                Ok((new_root, path, peg(2, axis)))
-            } else {
-                let (root, mut path, axis) = htree_prove(q, i - lc)?;
-                let sib = htree_node_digest(p);
-                let new_root = hash_ten_cell(sib, root).map_err(|e| js_err(format!("{e:?}")))?;
-                path.push(sib);
-                Ok((new_root, path, peg(3, axis)))
-            }
-        }
-    }
-}
-
-/// `++verify-merk-proof`: recompute the root from leaf + axis + path. Used by
-/// tests as the correctness oracle (the chain runs the equivalent verifier).
-#[cfg(test)]
-fn merk_verify_root(
-    leaf: [u64; 5],
-    axis: u64,
-    path: &[[u64; 5]],
-) -> Result<Option<[u64; 5]>, JsValue> {
-    let mut axis = axis;
-    let mut leaf = leaf;
-    let mut idx = 0usize;
-    if axis == 0 {
-        return Ok(None);
-    }
-    loop {
-        if axis == 1 {
-            return Ok(if idx == path.len() { Some(leaf) } else { None });
-        }
-        if idx >= path.len() {
-            return Ok(None);
-        }
-        let sib = path[idx];
-        if axis == 2 {
-            let r = hash_ten_cell(leaf, sib).map_err(|e| js_err(format!("{e:?}")))?;
-            return Ok(if idx + 1 == path.len() { Some(r) } else { None });
-        }
-        if axis == 3 {
-            let r = hash_ten_cell(sib, leaf).map_err(|e| js_err(format!("{e:?}")))?;
-            return Ok(if idx + 1 == path.len() { Some(r) } else { None });
-        }
-        if axis % 2 == 0 {
-            leaf = hash_ten_cell(leaf, sib).map_err(|e| js_err(format!("{e:?}")))?;
-            axis /= 2;
-        } else {
-            leaf = hash_ten_cell(sib, leaf).map_err(|e| js_err(format!("{e:?}")))?;
-            axis = (axis - 1) / 2;
-        }
-        idx += 1;
-    }
-}
-
-/// Build the hashable tree for an OR lock from its (already power-of-two,
-/// padded) leaf spend-condition hashes: `[leaf+tag, balanced-payload]`.
-fn or_hashable_tree(arena: &mut Arena, leaf_hashes: &[[u64; 5]], size: usize) -> HTree {
-    fn balanced(hs: &[[u64; 5]]) -> HTree {
-        if hs.len() == 1 {
-            HTree::Leaf(hs[0])
-        } else {
-            let half = hs.len() / 2;
-            HTree::Node(
-                Box::new(balanced(&hs[..half])),
-                Box::new(balanced(&hs[half..])),
-            )
-        }
-    }
-    let tag_atom = arena.alloc_atom_u64(size as u64);
-    let tag_digest = hash_noun_varlen(tag_atom, arena).unwrap_or([0; 5]);
-    HTree::Node(Box::new(HTree::Leaf(tag_digest)), Box::new(balanced(leaf_hashes)))
-}
-
-/// True if a pkh-signature-map value is an all-zero placeholder slot.
-fn is_placeholder_sig(value: Noun, arena: &Arena) -> bool {
-    fn all_zero(noun: Noun, arena: &Arena, count: usize) -> bool {
-        let mut cur = noun;
-        for _ in 0..count.saturating_sub(1) {
-            let Some((head, tail)) = (match cur {
-                Noun::Cell(id) => {
-                    let c = arena.cell(id);
-                    Some((c.head, c.tail))
-                }
-                _ => None,
-            }) else {
-                return false;
-            };
-            if noun_atom_u64(head, arena) != Some(0) {
-                return false;
-            }
-            cur = tail;
-        }
-        noun_atom_u64(cur, arena) == Some(0)
-    }
-    let Some((pk, sig)) = tuple2(value, arena) else {
-        return true;
-    };
-    let Some((x, y, _inf)) = tuple3(pk, arena) else {
-        return true;
-    };
-    if !all_zero(x, arena, 6) || !all_zero(y, arena, 6) {
-        return false;
-    }
-    let Some((chal, s)) = tuple2(sig, arena) else {
-        return true;
-    };
-    all_zero(chal, arena, 8) && all_zero(s, arena, 8)
-}
-
-/// Union the real (non-placeholder) entries of two pkh-signature z-maps,
-/// preferring real signatures from either side.
-fn merge_pkh_maps(arena: &mut Arena, base: Noun, extra: Noun) -> Result<Noun, JsValue> {
-    let mut out = base;
-    let mut stack = vec![extra];
-    while let Some(map) = stack.pop() {
-        if map == arena.atom0() {
-            continue;
-        }
-        let Some((node, left, right)) = decompose_map(map, arena) else {
-            continue;
-        };
-        if let Some((key, value)) = decompose_pair(node, arena) {
-            if !is_placeholder_sig(value, arena) {
-                out = canonical_zmap_put(arena, out, key, value)
-                    .map_err(|e| js_err(format!("zmap: {e:?}")))?;
-            }
-        }
-        stack.push(left);
-        stack.push(right);
-    }
-    Ok(out)
-}
-
-/// Merge the witness signatures of one spend (`[%1 [witness seeds fee]]`),
-/// taking seeds/fee from `base` and unioning the pkh-signature maps.
-fn merge_spend(arena: &mut Arena, base: Noun, extra: Noun) -> Result<Noun, JsValue> {
-    let (tag, body) = tuple2(base, arena).ok_or_else(|| js_err("malformed spend"))?;
-    let (witness, seeds, fee) = tuple3(body, arena).ok_or_else(|| js_err("malformed spend body"))?;
-    let (lmp, pkh, hax, tim) =
-        tuple4(witness, arena).ok_or_else(|| js_err("malformed witness"))?;
-    // Find the same spend's witness pkh map in `extra`.
-    let extra_pkh = tuple2(extra, arena)
-        .and_then(|(_t, b)| tuple3(b, arena))
-        .and_then(|(w, _s, _f)| tuple4(w, arena))
-        .map(|(_lmp, p, _h, _t)| p)
-        .unwrap_or_else(|| arena.atom0());
-    let merged_pkh = merge_pkh_maps(arena, pkh, extra_pkh)?;
-    let merged_witness = build_tuple(arena, &[lmp, merged_pkh, hax, tim]);
-    let merged_body = build_tuple(arena, &[merged_witness, seeds, fee]);
-    Ok(build_tuple(arena, &[tag, merged_body]))
-}
-
-/// Merge two wallet z-maps (`name -> spend`/`name -> witness`) keyed by name.
-fn collect_map_entries(map: Noun, arena: &Arena, out: &mut Vec<(Noun, Noun)>) {
-    if map == arena.atom0() || out.len() >= 256 {
-        return;
-    }
-    let Some((node, left, right)) = decompose_map(map, arena) else {
-        return;
-    };
-    if let Some(pair) = decompose_pair(node, arena) {
-        out.push(pair);
-    }
-    collect_map_entries(left, arena, out);
-    collect_map_entries(right, arena, out);
-}
-
-/// Combine two partially-signed v1 wallet transactions (`.psnt`) for the same
-/// transaction by unioning their per-input signature maps — the parallel
-/// multisig co-signing step.
-///
-/// VALIDATION: structurally tested (synthetic signatures); confirm against a
-/// real device-signed multisig `.psnt` before relying on it for funds.
-#[wasm_bindgen]
-pub fn merge_signed_tx(a: &[u8], b: &[u8]) -> Result<Vec<u8>, JsValue> {
-    let mut arena = Arena::new();
-    let ta = cue(a, &mut arena).map_err(|_| js_err("first tx is not a valid jam"))?;
-    let tb = cue(b, &mut arena).map_err(|_| js_err("second tx is not a valid jam"))?;
-    let (tag, name, spends_a, display, wd_a) =
-        tuple5(ta, &arena).ok_or_else(|| js_err("first tx is not a v1 wallet tx"))?;
-    let (_tb_tag, _tb_name, spends_b, _tb_display, wd_b) =
-        tuple5(tb, &arena).ok_or_else(|| js_err("second tx is not a v1 wallet tx"))?;
-
-    // Index b's spends by name (b58) for matching.
-    let mut b_spends = Vec::new();
-    collect_map_entries(spends_b, &arena, &mut b_spends);
-    let find_b = |name_noun: Noun, arena: &Arena| -> Noun {
-        let want = parse_hash(name_noun, arena);
-        for (k, v) in &b_spends {
-            if parse_hash(*k, arena) == want {
-                return *v;
-            }
-        }
-        arena.atom0()
-    };
-
-    // Rebuild the spends map with merged signatures.
-    let mut a_spends = Vec::new();
-    collect_map_entries(spends_a, &arena, &mut a_spends);
-    let mut merged_spends = arena.atom0();
-    for (name_noun, spend_a) in a_spends {
-        let extra = find_b(name_noun, &arena);
-        let merged = if extra == arena.atom0() {
-            spend_a
-        } else {
-            merge_spend(&mut arena, spend_a, extra)?
-        };
-        merged_spends = canonical_zmap_put(&mut arena, merged_spends, name_noun, merged)
-            .map_err(|e| js_err(format!("zmap: {e:?}")))?;
-    }
-
-    // Rebuild the witness-data map (`[%1 map]`) the same way.
-    let (wd_tag, wd_map_a) = tuple2(wd_a, &arena).ok_or_else(|| js_err("malformed witness-data"))?;
-    let wd_map_b = tuple2(wd_b, &arena).map(|(_t, m)| m).unwrap_or_else(|| arena.atom0());
-    let mut b_wits = Vec::new();
-    collect_map_entries(wd_map_b, &arena, &mut b_wits);
-    let mut a_wits = Vec::new();
-    collect_map_entries(wd_map_a, &arena, &mut a_wits);
-    let mut merged_wd_map = arena.atom0();
-    for (name_noun, wit_a) in a_wits {
-        let want = parse_hash(name_noun, &arena);
-        let extra_pkh = b_wits
-            .iter()
-            .find(|(k, _)| parse_hash(*k, &arena) == want)
-            .and_then(|(_, w)| tuple4(*w, &arena))
-            .map(|(_lmp, p, _h, _t)| p)
-            .unwrap_or_else(|| arena.atom0());
-        let merged_wit = if let Some((lmp, pkh, hax, tim)) = tuple4(wit_a, &arena) {
-            let mp = merge_pkh_maps(&mut arena, pkh, extra_pkh)?;
-            build_tuple(&mut arena, &[lmp, mp, hax, tim])
-        } else {
-            wit_a
-        };
-        merged_wd_map = canonical_zmap_put(&mut arena, merged_wd_map, name_noun, merged_wit)
-            .map_err(|e| js_err(format!("zmap: {e:?}")))?;
-    }
-    let merged_wd = build_tuple(&mut arena, &[wd_tag, merged_wd_map]);
-
-    let merged = build_tuple(&mut arena, &[tag, name, merged_spends, display, merged_wd]);
-    Ok(jam(merged, &arena))
-}
-
-#[wasm_bindgen]
-pub fn compose_tx_v1_unsigned(input: JsValue) -> Result<ComposedTransactionV1, JsValue> {
-    let input: ComposeTxV1Input =
-        serde_wasm_bindgen::from_value(input).map_err(|e| js_err(format!("bad input: {e}")))?;
-    compose_tx_v1_unsigned_inner(input)
-}
-
-/// Compose using largest-first inputs without enumerating note subsets.
-#[wasm_bindgen]
-pub fn compose_tx_v1_min_inputs(input: JsValue) -> Result<ComposedTransactionV1, JsValue> {
-    let input: ComposeTxV1Input = serde_wasm_bindgen::from_value(input)
-        .map_err(|e| js_err(format!("bad input: {e}")))?;
-    compose_tx_v1_with_selection(input, true)
-}
-
-pub fn estimate_tx_v1_fee(input: ComposeTxV1Input) -> Result<u64, String> {
-    let composed = compose_tx_v1_unsigned_inner(input).map_err(js_value_to_string)?;
-    let summary: serde_json::Value = serde_json::from_str(&composed.summary_json)
-        .map_err(|e| format!("bad composed transaction summary: {e}"))?;
-    summary
-        .get("total_fees")
-        .and_then(serde_json::Value::as_u64)
-        .ok_or_else(|| "composed transaction summary is missing total_fees".to_string())
-}
-
-fn js_value_to_string(value: JsValue) -> String {
-    value
-        .as_string()
-        .unwrap_or_else(|| format!("compose transaction failed: {value:?}"))
-}
-
-fn compose_tx_v1_unsigned_inner(input: ComposeTxV1Input) -> Result<ComposedTransactionV1, JsValue> {
-    compose_tx_v1_with_selection(input, false)
-}
-
-fn compose_tx_v1_with_selection(
-    input: ComposeTxV1Input,
-    largest_first: bool,
-) -> Result<ComposedTransactionV1, JsValue> {
-    if input.outputs.is_empty() {
-        return Err(js_err("at least one output is required"));
-    }
-    if input.notes.is_empty() {
-        return Err(js_err("at least one input note is required"));
-    }
-
-    let coinbase_rel_min = input.coinbase_rel_min.unwrap_or(DEFAULT_COINBASE_REL_MIN);
-    let fee_policy = fee_policy_from_input(&input);
-    let current_height = input.current_height.unwrap_or(fee_policy.bythos_phase);
-    let source_pkh = parse_b58_hash(&input.source_pkh)?;
-
-    let mut arena = Arena::new();
-    let ctx = tx_id_ctx(&mut arena)?;
-
-    // Parse an optional multisig source lock (sorted, deduped digests).
-    let source_multisig: Option<(u64, Vec<[u64; 5]>)> = match &input.source_multisig {
-        Some(ms) => {
-            if ms.m == 0 {
-                return Err(js_err("multisig source requires m >= 1"));
-            }
-            let mut digests: Vec<[u64; 5]> = Vec::with_capacity(ms.pkhs.len());
-            for pkh_b58 in &ms.pkhs {
-                digests.push(parse_b58_hash(pkh_b58)?);
-            }
-            digests.sort();
-            digests.dedup();
-            if (ms.m as usize) > digests.len() {
-                return Err(js_err("multisig source requires m <= unique signers"));
-            }
-            Some((ms.m, digests))
-        }
-        None => None,
-    };
-
-    // Change returns to the same lock the inputs use: the multisig lock for a
-    // multisig source, else the source pkh.
-    let (refund_lock, refund_recipient_b58) = if let Some((m, pkhs)) = &source_multisig {
-        let ms_lock = build_pkh_lock_multisig(&mut arena, *m, pkhs)?;
-        let ms_list = build_list(&mut arena, &[ms_lock]);
-        let root = hash_lock_primitives_list(ms_list, &arena, &ctx)?;
-        (ms_list, hash_to_b58(root))
-    } else {
-        let refund_pkh = build_pkh_lock(&mut arena, source_pkh)?;
-        (build_list(&mut arena, &[refund_pkh]), input.source_pkh.clone())
-    };
-    let refund_lock_root = hash_lock_primitives_list(refund_lock, &arena, &ctx)?;
-    let (refund_note_data, _) = build_note_data_with_lock(&mut arena, refund_lock)?;
-
-    // Parse + normalize notes.
-    let mut notes: Vec<NoteSpec> = input
-        .notes
-        .iter()
-        .map(|note| {
-            build_note_spec(
-                &mut arena,
-                note,
-                source_pkh,
-                source_multisig.as_ref(),
-                input.source_or_lock.as_ref(),
-                &ctx,
-                coinbase_rel_min,
-                fee_policy.bythos_phase,
-            )
-        })
-        .collect::<Result<_, _>>()?;
-
-    // Keep a deterministic base order. Candidate generation will choose and
-    // reorder subsets by fee score.
-    notes.sort_by(|a, b| {
-        a.assets
-            .cmp(&b.assets)
-            .then_with(|| a.origin_page.cmp(&b.origin_page))
-    });
-
-    // Build output seeds (largest first).
-    let mut seeds: Vec<SeedSpec> = Vec::new();
-    let mut output_total = 0u64;
-    for output in &input.outputs {
-        if output.amount == 0 {
-            return Err(js_err("output amount must be > 0"));
-        }
-        output_total = output_total.saturating_add(output.amount);
-        let seed = build_output_seed_spec(&mut arena, output, &ctx)?;
-        seeds.push(seed);
-    }
-    seeds.sort_by(|a, b| b.gift.cmp(&a.gift));
-
-    let best_plan = if largest_first {
-        choose_largest_first_plan(
-            &mut arena,
-            notes.as_slice(),
-            seeds.as_slice(),
-            source_pkh,
-            refund_lock_root,
-            refund_note_data,
-            &refund_recipient_b58,
-            current_height,
-            fee_policy,
-        )
-    } else {
-        choose_best_candidate_plan(
-            &mut arena,
-            notes.as_slice(),
-            seeds.as_slice(),
-            output_total,
-            source_pkh,
-            refund_lock_root,
-            refund_note_data,
-            &refund_recipient_b58,
-            current_height,
-            fee_policy,
-        )
-    }?;
-    let plans = best_plan.plans;
-    let final_fee_breakdown = best_plan.fee_breakdown;
-
-    let mut spends_map = arena.atom0();
-    let mut witness_data_map = arena.atom0();
-    let mut inputs_display_map = arena.atom0();
-    let mut summary_inputs = Vec::new();
-    let mut summary_spends = Vec::new();
-    let mut total_fees = 0u64;
-
-    for plan in &plans {
-        let note = &notes[plan.note_index];
-        let built = build_spend_from_plan(
-            &mut arena,
-            note,
-            plan,
-            note.witness_unsigned,
-            refund_lock_root,
-            refund_note_data,
-            &refund_recipient_b58,
-        )?;
-
-        spends_map = canonical_zmap_put(&mut arena, spends_map, note.name_noun, built.spend)
-            .map_err(|e| js_err(format!("zmap: {e:?}")))?;
-
-        witness_data_map =
-            canonical_zmap_put(&mut arena, witness_data_map, note.name_noun, built.witness)
-                .map_err(|e| js_err(format!("zmap: {e:?}")))?;
-        inputs_display_map =
-            canonical_zmap_put(&mut arena, inputs_display_map, note.name_noun, note.lock)
-                .map_err(|e| js_err(format!("zmap: {e:?}")))?;
-
-        total_fees = total_fees.saturating_add(plan.fee);
-
-        summary_inputs.push(serde_json::json!({
-            "name_first": hash_to_b58(note.name_first),
-            "name_last": hash_to_b58(note.name_last),
-            "assets": note.assets,
-            "capacity": note.capacity,
-        }));
-
-        summary_spends.push(serde_json::json!({
-            "input": format!("{} {}", hash_to_b58(note.name_first), hash_to_b58(note.name_last)),
-            "fee": plan.fee,
-            "refund": plan.refund_gift,
-            "seeds": plan.accepted.iter().map(|s| serde_json::json!({
-                "recipient": s.recipient_b58,
-                "gift": s.gift,
-            })).collect::<Vec<_>>(),
-        }));
-    }
-
-    let tx_id = compute_tx_id_v1(spends_map, &arena, &ctx)?;
-    let tx_id_b58 = hash_to_b58(tx_id);
-    let id_noun = build_hash_noun(&mut arena, tx_id);
-    let version_atom = arena.alloc_atom_u64(1);
-    let raw_tx = build_tuple(&mut arena, &[version_atom, id_noun, spends_map]);
-    let raw_jam = jam(raw_tx, &arena);
-
-    let wallet_name = arena.alloc_atom_bytes(tx_id_b58.as_bytes());
-    let v1_tag = arena.alloc_atom_u64(1);
-    let empty = arena.atom0();
-    let input_display = build_tuple(&mut arena, &[v1_tag, inputs_display_map]);
-    let display = build_tuple(&mut arena, &[input_display, empty]);
-    let witness_data = build_tuple(&mut arena, &[v1_tag, witness_data_map]);
-    let wallet_tx = build_tuple(
-        &mut arena,
-        &[v1_tag, wallet_name, spends_map, display, witness_data],
-    );
-    let wallet_jam = jam(wallet_tx, &arena);
-
-    let summary = serde_json::json!({
-        "tx_id": tx_id_b58,
-        "source_pkh": input.source_pkh,
-        "outputs": input.outputs,
-        "inputs_used": summary_inputs,
-        "spends": summary_spends,
-        "total_fees": total_fees,
-        "minimum_fee": final_fee_breakdown.minimum_fee,
-        "seed_words": final_fee_breakdown.seed_words,
-        "witness_words": final_fee_breakdown.witness_words,
-        "coinbase_rel_min": coinbase_rel_min,
-        "current_height": current_height,
-        "bythos_phase": fee_policy.bythos_phase,
-        "base_fee": fee_policy.base_fee,
-        "input_fee_divisor": fee_policy.input_fee_divisor,
-        "min_fee": fee_policy.min_fee,
-    });
-
-    Ok(ComposedTransactionV1 {
-        tx_id: tx_id_b58,
-        raw_jam,
-        wallet_jam,
-        summary_json: summary.to_string(),
-    })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn first_zmap_value(map: Noun, arena: &Arena) -> Noun {
-        let (node, _left, _right) = decompose_map(map, arena).expect("zmap");
-        let (_key, value) = decompose_pair(node, arena).expect("zmap node");
-        value
-    }
-
-    fn count_zmap_nodes(map: Noun, arena: &Arena) -> u64 {
-        if map == arena.atom0() {
-            return 0;
-        }
-        let Some((_, left, right)) = decompose_map(map, arena) else {
-            return 0;
-        };
-        1 + count_zmap_nodes(left, arena) + count_zmap_nodes(right, arena)
-    }
-
-    #[test]
-    fn wallet_tx_v1_populates_witness_data_and_inputs_display() {
-        let source_pkh_b58 = "9yPePjfWAdUnzaQKyxcRXKRa5PpUzKKEwtpECBZsUYt9Jd7egSDEWoV";
-
-        let source_pkh = parse_b58_hash(source_pkh_b58).expect("source pkh");
-
-        let mut arena = Arena::new();
-        let ctx = tx_id_ctx(&mut arena).expect("tx id ctx");
-
-        let simple_pkh = build_pkh_lock(&mut arena, source_pkh).expect("lock primitive");
-        let simple_lock = build_list(&mut arena, &[simple_pkh]);
-        let simple_lock_hash =
-            hash_lock_primitives_list(simple_lock, &arena, &ctx).expect("lock hash");
-        let note_first =
-            compute_first_name_from_lock_hash(simple_lock_hash, &ctx).expect("first name");
-
-        let composed = compose_tx_v1_unsigned_inner(ComposeTxV1Input {
-            source_pkh: source_pkh_b58.to_string(),
-            notes: vec![NoteInput {
-                name_first: hash_to_b58(note_first),
-                name_last: source_pkh_b58.to_string(),
-                origin_page: 1,
-                assets: 100_000_000,
-                version: 1,
-            }],
-            outputs: vec![OutputInput {
-                recipient: RecipientInput::Pkh(source_pkh_b58.to_string()),
-                amount: 65_536,
-                alias: None,
-                timelock: None,
-                hashlock: None,
-                burn: false,
-                lock_root_only: false,
-                or_branches: None,
-            }],
-            coinbase_rel_min: None,
-            current_height: Some(BYTHOS_PHASE),
-            bythos_phase: None,
-            base_fee: None,
-            input_fee_divisor: None,
-            min_fee: None,
-            source_multisig: None,
-            source_or_lock: None,
-        })
-        .expect("compose");
-
-        let mut decode_arena = Arena::new();
-        let tx_noun = tx_types::pokenoun::cue(&composed.wallet_jam, &mut decode_arena)
-            .expect("cue wallet tx");
-
-        let (tag, _name, spends, display, witness_data) =
-            tuple5(tx_noun, &decode_arena).expect("wallet tx tuple5");
-        assert_eq!(noun_atom_u64(tag, &decode_arena), Some(1));
-
-        let (inputs, _outputs) = tuple2(display, &decode_arena).expect("display tuple2");
-        let (in_tag, in_map) = tuple2(inputs, &decode_arena).expect("input-display tuple2");
-        assert_eq!(noun_atom_u64(in_tag, &decode_arena), Some(1));
-
-        let (wd_tag, wd_map) = tuple2(witness_data, &decode_arena).expect("witness-data tuple2");
-        assert_eq!(noun_atom_u64(wd_tag, &decode_arena), Some(1));
-
-        let spend_count = count_zmap_nodes(spends, &decode_arena);
-        assert!(spend_count > 0);
-        assert_eq!(spend_count, count_zmap_nodes(in_map, &decode_arena));
-        assert_eq!(spend_count, count_zmap_nodes(wd_map, &decode_arena));
-
-        let witness = first_zmap_value(wd_map, &decode_arena);
-        let (lmp, _pkh, _hax, _tim) = tuple4(witness, &decode_arena).expect("witness tuple4");
-        let (version, _spend_condition, axis, _proof) =
-            decompose_lock_merkle_proof(lmp, &decode_arena).expect("stub lmp");
-        assert!(version.is_none());
-        assert_eq!(noun_atom_u64(axis, &decode_arena), Some(1));
-    }
-
-    #[test]
-    fn wallet_tx_v1_multisig_source_reconstructs_multisig_lock() {
-        // Three synthetic signer pkhs and a 2-of-3 lock.
-        let m = 2u64;
-        let signer_b58: Vec<String> = [[1u64, 0, 0, 0, 0], [2, 0, 0, 0, 0], [3, 0, 0, 0, 0]]
-            .iter()
-            .map(|d| hash_to_b58(*d))
-            .collect();
-
-        let mut arena = Arena::new();
-        let ctx = tx_id_ctx(&mut arena).expect("tx id ctx");
-
-        // Derive the note's first name from the 2-of-3 multisig lock so the
-        // input reconstruction must match.
-        let mut digests: Vec<[u64; 5]> =
-            signer_b58.iter().map(|b| parse_b58_hash(b).unwrap()).collect();
-        digests.sort();
-        digests.dedup();
-        let ms_lock = build_pkh_lock_multisig(&mut arena, m, &digests).unwrap();
-        let ms_list = build_list(&mut arena, &[ms_lock]);
-        let ms_root = hash_lock_primitives_list(ms_list, &arena, &ctx).unwrap();
-        let note_first = compute_first_name_from_lock_hash(ms_root, &ctx).unwrap();
-
-        // Compose succeeds only if the multisig lock reconstruction matches the
-        // note name (proves source_multisig threading + lock build).
-        let composed = compose_tx_v1_unsigned_inner(ComposeTxV1Input {
-            source_pkh: signer_b58[0].clone(),
-            notes: vec![NoteInput {
-                name_first: hash_to_b58(note_first),
-                name_last: signer_b58[0].clone(),
-                origin_page: 1,
-                assets: 100_000_000,
-                version: 1,
-            }],
-            outputs: vec![OutputInput {
-                recipient: RecipientInput::Pkh(signer_b58[0].clone()),
-                amount: 65_536,
-                alias: None,
-                timelock: None,
-                hashlock: None,
-                burn: false,
-                lock_root_only: false,
-                or_branches: None,
-            }],
-            coinbase_rel_min: None,
-            current_height: Some(BYTHOS_PHASE),
-            bythos_phase: None,
-            base_fee: None,
-            input_fee_divisor: None,
-            min_fee: None,
-            source_multisig: Some(MultisigSourceInput {
-                m,
-                pkhs: signer_b58.clone(),
-            }),
-            source_or_lock: None,
-        })
-        .expect("compose multisig");
-
-        // The input-display lock must be the m-of-n multisig (m == 2).
-        let mut decode_arena = Arena::new();
-        let tx_noun =
-            tx_types::pokenoun::cue(&composed.wallet_jam, &mut decode_arena).expect("cue");
-        let (_tag, _name, _spends, display, _wd) = tuple5(tx_noun, &decode_arena).expect("tuple5");
-        let (inputs, _outputs) = tuple2(display, &decode_arena).expect("display");
-        let (_in_tag, in_map) = tuple2(inputs, &decode_arena).expect("inputs");
-        let lock_list = first_zmap_value(in_map, &decode_arena);
-        let (pkh_prim, _rest) = uncons(lock_list, &decode_arena).expect("lock list head");
-        let (_header, body) = tuple2(pkh_prim, &decode_arena).expect("pkh prim");
-        let (m_noun, _set) = tuple2(body, &decode_arena).expect("pkh body");
-        assert_eq!(noun_atom_u64(m_noun, &decode_arena), Some(2));
-    }
-
-    #[test]
-    fn wallet_tx_v1_timelock_output_changes_lock_root() {
-        let source_pkh_b58 = "9yPePjfWAdUnzaQKyxcRXKRa5PpUzKKEwtpECBZsUYt9Jd7egSDEWoV";
-        let source_pkh = parse_b58_hash(source_pkh_b58).unwrap();
-
-        let mut arena = Arena::new();
-        let ctx = tx_id_ctx(&mut arena).expect("tx id ctx");
-        let simple_pkh = build_pkh_lock(&mut arena, source_pkh).unwrap();
-        let simple_lock = build_list(&mut arena, &[simple_pkh]);
-        let simple_lock_hash = hash_lock_primitives_list(simple_lock, &arena, &ctx).unwrap();
-        let note_first = compute_first_name_from_lock_hash(simple_lock_hash, &ctx).unwrap();
-
-        let make = |timelock: Option<TimelockSpec>| {
-            compose_tx_v1_unsigned_inner(ComposeTxV1Input {
-                source_pkh: source_pkh_b58.to_string(),
-                notes: vec![NoteInput {
-                    name_first: hash_to_b58(note_first),
-                    name_last: source_pkh_b58.to_string(),
-                    origin_page: 1,
-                    assets: 100_000_000,
-                    version: 1,
-                }],
-                outputs: vec![OutputInput {
-                    recipient: RecipientInput::Pkh(source_pkh_b58.to_string()),
-                    amount: 65_536,
-                    alias: None,
-                    timelock,
-                    hashlock: None,
-                    burn: false,
-                    lock_root_only: false,
-                    or_branches: None,
-                }],
-                coinbase_rel_min: None,
-                current_height: Some(BYTHOS_PHASE),
-                bythos_phase: None,
-                base_fee: None,
-                input_fee_divisor: None,
-                min_fee: None,
-                source_multisig: None,
-                source_or_lock: None,
-            })
-            .expect("compose")
-        };
-
-        let plain = make(None);
-        let timelocked = make(Some(TimelockSpec {
-            rel_min: None,
-            rel_max: None,
-            abs_min: Some(120_000),
-            abs_max: None,
-        }));
-        // The timelocked output's lock (pkh + tim) hashes differently, so the
-        // whole transaction id changes — proving the %tim primitive is in the
-        // output's spend-condition. (The no-bounds rejection path returns a
-        // JsValue error, which only runs under wasm, so it isn't asserted here.)
-        assert_ne!(plain.tx_id, timelocked.tx_id);
-    }
-
-    #[test]
-    fn wallet_tx_v1_hashlock_and_burn_outputs() {
-        let source_pkh_b58 = "9yPePjfWAdUnzaQKyxcRXKRa5PpUzKKEwtpECBZsUYt9Jd7egSDEWoV";
-        let source_pkh = parse_b58_hash(source_pkh_b58).unwrap();
-
-        let mut arena = Arena::new();
-        let ctx = tx_id_ctx(&mut arena).expect("tx id ctx");
-        let simple_pkh = build_pkh_lock(&mut arena, source_pkh).unwrap();
-        let simple_lock = build_list(&mut arena, &[simple_pkh]);
-        let simple_lock_hash = hash_lock_primitives_list(simple_lock, &arena, &ctx).unwrap();
-        let note_first = compute_first_name_from_lock_hash(simple_lock_hash, &ctx).unwrap();
-
-        let commit_a = hash_to_b58([7u64, 0, 0, 0, 0]);
-        let commit_b = hash_to_b58([8u64, 0, 0, 0, 0]);
-        let make = |hashlock: Option<Vec<String>>, burn: bool| {
-            compose_tx_v1_unsigned_inner(ComposeTxV1Input {
-                source_pkh: source_pkh_b58.to_string(),
-                notes: vec![NoteInput {
-                    name_first: hash_to_b58(note_first),
-                    name_last: source_pkh_b58.to_string(),
-                    origin_page: 1,
-                    assets: 100_000_000,
-                    version: 1,
-                }],
-                outputs: vec![OutputInput {
-                    recipient: RecipientInput::Pkh(source_pkh_b58.to_string()),
-                    amount: 65_536,
-                    alias: None,
-                    timelock: None,
-                    hashlock,
-                    burn,
-                    lock_root_only: false,
-                    or_branches: None,
-                }],
-                coinbase_rel_min: None,
-                current_height: Some(BYTHOS_PHASE),
-                bythos_phase: None,
-                base_fee: None,
-                input_fee_divisor: None,
-                min_fee: None,
-                source_multisig: None,
-                source_or_lock: None,
-            })
-            .expect("compose")
-        };
-
-        let plain = make(None, false);
-        let hax_a = make(Some(vec![commit_a.clone()]), false);
-        let hax_b = make(Some(vec![commit_b.clone()]), false);
-        let burned = make(None, true);
-
-        // Hashlock changes the lock, and — critically — DIFFERENT commitments
-        // produce DIFFERENT tx-ids. This is the regression guard for the old
-        // `%hax` stub that hashed a fixed placeholder instead of the z-set.
-        assert_ne!(plain.tx_id, hax_a.tx_id);
-        assert_ne!(hax_a.tx_id, hax_b.tx_id);
-        // Burn is also a distinct lock.
-        assert_ne!(plain.tx_id, burned.tx_id);
-    }
-
-    // Build a TxIdCtx for tests.
-    fn test_ctx(arena: &mut Arena) -> TxIdCtx {
-        tx_id_ctx(arena).expect("tx id ctx")
-    }
-
-    /// Golden lock-root vectors copied verbatim from nockchain-wallet's own
-    /// tests (`crates/nockchain-wallet/src/tests.rs`,
-    /// `planner_recipient_outputs_match_hoon_lock_root_vectors`). Proves our
-    /// pkh / multisig lock hashing matches the canonical wallet exactly —
-    /// which also validates the per-leaf hashing OR-composed locks reuse.
-    #[test]
-    fn lock_roots_match_nockchain_wallet_vectors() {
-        const ADDRESS_A: &str = "9yPePjfWAdUnzaQKyxcRXKRa5PpUzKKEwtpECBZsUYt9Jd7egSDEWoV";
-        const ADDRESS_B: &str = "9phXGACnW4238oqgvn2gpwaUjG3RAqcxq2Ash2vaKp8KjzSd3MQ56Jt";
-        const EXPECTED_PKH_ROOT: &str = "DKrgXqE8bXR1uBZ3t4vU13m2KquGCDbnn1PeoPL7dxSHTucGPFDPt53";
-        const EXPECTED_MULTISIG_2_OF_2: &str =
-            "4eMAT3BuhLPjYFronoYJ9RSLVSgveCL3nQB7RHSLZzjBTiYCxEzkzEH";
-
-        let mut arena = Arena::new();
-        let ctx = test_ctx(&mut arena);
-        let a = parse_b58_hash(ADDRESS_A).unwrap();
-        let b = parse_b58_hash(ADDRESS_B).unwrap();
-
-        // 1-of-1 P2PKH lock root.
-        let pkh = build_pkh_lock(&mut arena, a).unwrap();
-        let lock = build_list(&mut arena, &[pkh]);
-        let root = hash_lock_primitives_list(lock, &arena, &ctx).unwrap();
-        assert_eq!(hash_to_b58(root), EXPECTED_PKH_ROOT);
-
-        // 2-of-2 multisig lock root.
-        let mut digests = vec![a, b];
-        digests.sort();
-        digests.dedup();
-        let ms = build_pkh_lock_multisig(&mut arena, 2, &digests).unwrap();
-        let ms_lock = build_list(&mut arena, &[ms]);
-        let ms_root = hash_lock_primitives_list(ms_lock, &arena, &ctx).unwrap();
-        assert_eq!(hash_to_b58(ms_root), EXPECTED_MULTISIG_2_OF_2);
-    }
-
-    #[test]
-    fn inspect_tx_builds_tree_for_composed_draft() {
-        let source = "9yPePjfWAdUnzaQKyxcRXKRa5PpUzKKEwtpECBZsUYt9Jd7egSDEWoV";
-        let source_pkh = parse_b58_hash(source).unwrap();
-        let mut arena = Arena::new();
-        let ctx = test_ctx(&mut arena);
-        let pkh = build_pkh_lock(&mut arena, source_pkh).unwrap();
-        let lock = build_list(&mut arena, &[pkh]);
-        let note_first =
-            compute_first_name_from_lock_hash(hash_lock_primitives_list(lock, &arena, &ctx).unwrap(), &ctx)
-                .unwrap();
-
-        let composed = compose_tx_v1_unsigned_inner(ComposeTxV1Input {
-            source_pkh: source.to_string(),
-            notes: vec![NoteInput {
-                name_first: hash_to_b58(note_first),
-                name_last: source.to_string(),
-                origin_page: 1,
-                assets: 100_000_000,
-                version: 1,
-            }],
-            outputs: vec![OutputInput {
-                recipient: RecipientInput::Pkh(source.to_string()),
-                amount: 65_536,
-                alias: None,
-                timelock: Some(TimelockSpec {
-                    rel_min: None,
-                    rel_max: None,
-                    abs_min: Some(99_000),
-                    abs_max: None,
-                }),
-                hashlock: None,
-                burn: false,
-                lock_root_only: false,
-                or_branches: None,
-            }],
-            coinbase_rel_min: None,
-            current_height: Some(BYTHOS_PHASE),
-            bythos_phase: None,
-            base_fee: None,
-            input_fee_divisor: None,
-            min_fee: None,
-            source_multisig: None,
-            source_or_lock: None,
-        })
-        .expect("compose");
-
-        // The typed inspector decodes the composed draft into a labeled tree.
-        let tree = crate::review_v1::inspect_tx(&composed.wallet_jam).expect("inspect");
-        assert_eq!(tree.label, "transaction");
-        assert!(!tree.children.is_empty());
-        // The composed jam serializes (round-trips through the inspector) and
-        // surfaces the timelock somewhere in the tree.
-        fn has_label(n: &crate::review_v1::TxTreeNode, want: &str) -> bool {
-            n.label == want || n.children.iter().any(|c| has_label(c, want))
-        }
-        assert!(has_label(&tree, "timelock"));
-
-        // Merging the signed tx with itself must produce a structurally valid
-        // re-jammed wallet tx (no corruption; signature union is exercised).
-        let merged = merge_signed_tx(&composed.wallet_jam, &composed.wallet_jam).expect("merge");
-        let mut merge_arena = Arena::new();
-        let merged_noun = cue(&merged, &mut merge_arena).expect("cue merged");
-        assert!(tuple5(merged_noun, &merge_arena).is_some());
-        let merged_tree = crate::review_v1::inspect_tx(&merged).expect("inspect merged");
-        assert_eq!(merged_tree.label, "transaction");
-    }
-
-    /// Golden vectors for timelock, hashlock, and OR-composed (`%2`/`%4`)
-    /// lock roots, copied from nockchain's `lock_hash_matches_known_hoon_vectors`
-    /// (`crates/nockchain-types/.../tx.rs`). Closes the OR-composed fund-safety
-    /// gap: the tree hashing now matches the canonical source on real vectors.
-    #[test]
-    fn or_composed_lock_roots_match_nockchain_vectors() {
-        const ADDRESS_A: &str = "9yPePjfWAdUnzaQKyxcRXKRa5PpUzKKEwtpECBZsUYt9Jd7egSDEWoV";
-        const ADDRESS_B: &str = "9phXGACnW4238oqgvn2gpwaUjG3RAqcxq2Ash2vaKp8KjzSd3MQ56Jt";
-        const EXPECTED_TIM: &str = "66FLtgznHvE7v4Fi4wZ6aA9EzsPD6pfaL3qL85apJuiBF8unRKXVsor";
-        const EXPECTED_HAX: &str = "4kwz3RMCacfRXY3ydNoQ1tsUKuzaBEzGSpX9GpSWf8T3Rj24Ucuj6v4";
-        const EXPECTED_V2: &str = "e3qeUqDf6ZTkayiiQDpKpax6RqXMBAMRLtrppvL41EdyJYFj743ZKB";
-        const EXPECTED_V4: &str = "6ezbUN1ozEvZi9TUGVN1pY2TcCJc5KWoCzjj519ihE6LGupvJpnysjo";
-
-        let mut arena = Arena::new();
-        let ctx = test_ctx(&mut arena);
-        let a = parse_b58_hash(ADDRESS_A).unwrap();
-        let b = parse_b58_hash(ADDRESS_B).unwrap();
-
-        // Single-condition timelock: [tim(rel 3..10, abs 20..)].
-        let tim = build_tim_lock_full(&mut arena, Some(3), Some(10), Some(20), None);
-        let tim_sc = build_list(&mut arena, &[tim]);
-        let tim_root = hash_lock_primitives_list(tim_sc, &arena, &ctx).unwrap();
-        assert_eq!(hash_to_b58(tim_root), EXPECTED_TIM);
-
-        // Single-condition hashlock over {A, B}.
-        let hax = build_hax_lock(&mut arena, &{
-            let mut v = vec![a, b];
-            v.sort();
-            v.dedup();
-            v
-        })
-        .unwrap();
-        let hax_sc = build_list(&mut arena, &[hax]);
-        let hax_root = hash_lock_primitives_list(hax_sc, &arena, &ctx).unwrap();
-        assert_eq!(hash_to_b58(hax_root), EXPECTED_HAX);
-
-        // Spend-condition hashes for the tree leaves.
-        let pkh_a = build_pkh_lock(&mut arena, a).unwrap();
-        let sc_pkh = build_list(&mut arena, &[pkh_a]);
-        let h_pkh = hash_lock_primitives_list(sc_pkh, &arena, &ctx).unwrap();
-        let h_tim = tim_root;
-        let h_hax = hax_root;
-        let brn = build_brn_lock(&mut arena);
-        let sc_brn = build_list(&mut arena, &[brn]);
-        let h_brn = hash_lock_primitives_list(sc_brn, &arena, &ctx).unwrap();
-
-        // %2 tree: [pkh(1,[A]), tim].
-        let v2_root = hash_lock_tree_root(&mut arena, &[h_pkh, h_tim], 2).unwrap();
-        assert_eq!(hash_to_b58(v2_root), EXPECTED_V2);
-
-        // %4 tree: V4{ V2{pkh, tim}, V2{hax, burn} } → leaves [pkh, tim, hax, burn].
-        let v4_root = hash_lock_tree_root(&mut arena, &[h_pkh, h_tim, h_hax, h_brn], 4).unwrap();
-        assert_eq!(hash_to_b58(v4_root), EXPECTED_V4);
-    }
-
-    /// For every leaf of an OR lock, the prover's (axis, path) must verify back
-    /// to the lock root via the chain's verifier — and that root must equal the
-    /// wallet-validated `hash_lock_tree_root`. This is the fund-safety oracle
-    /// for spending OR-composed inputs (HTLC claim/refund).
-    /// Spend from an OR-composed (HTLC-shaped) input: branch 0 = recipient +
-    /// preimage, branch 1 = refund pkh + timelock. Compose spending branch 0
-    /// and confirm the input witness is a full lock-merkle-proof that verifies
-    /// back to the input's lock root.
-    #[test]
-    fn lock_root_only_output_has_empty_note_data() {
-        let source = "9yPePjfWAdUnzaQKyxcRXKRa5PpUzKKEwtpECBZsUYt9Jd7egSDEWoV";
-        let source_pkh = parse_b58_hash(source).unwrap();
-        let mut arena = Arena::new();
-        let ctx = test_ctx(&mut arena);
-        let pkh = build_pkh_lock(&mut arena, source_pkh).unwrap();
-        let lock = build_list(&mut arena, &[pkh]);
-        let note_first =
-            compute_first_name_from_lock_hash(hash_lock_primitives_list(lock, &arena, &ctx).unwrap(), &ctx)
-                .unwrap();
-        let make = |lock_root_only: bool| {
-            compose_tx_v1_unsigned_inner(ComposeTxV1Input {
-                source_pkh: source.to_string(),
-                notes: vec![NoteInput {
-                    name_first: hash_to_b58(note_first),
-                    name_last: source.to_string(),
-                    origin_page: 1,
-                    assets: 100_000_000,
-                    version: 1,
-                }],
-                outputs: vec![OutputInput {
-                    recipient: RecipientInput::Pkh(source.to_string()),
-                    amount: 65_536,
-                    alias: None,
-                    timelock: None,
-                    hashlock: None,
-                    burn: false,
-                    lock_root_only,
-                    or_branches: None,
-                }],
-                coinbase_rel_min: None,
-                current_height: Some(BYTHOS_PHASE),
-                bythos_phase: None,
-                base_fee: None,
-                input_fee_divisor: None,
-                min_fee: None,
-                source_multisig: None,
-                source_or_lock: None,
-            })
-            .expect("compose")
-        };
-        // The hidden lock changes note_data → a different transaction.
-        assert_ne!(make(false).tx_id, make(true).tx_id);
-
-        // At least one output seed of the private tx has empty note_data.
-        let composed = make(true);
-        let mut da = Arena::new();
-        let tx = cue(&composed.wallet_jam, &mut da).unwrap();
-        let (_t, _n, spends, _d, _w) = tuple5(tx, &da).unwrap();
-        let (node, _l, _r) = decompose_map(spends, &da).unwrap();
-        let (_name, spend) = decompose_pair(node, &da).unwrap();
-        let (_tag, body) = tuple2(spend, &da).unwrap();
-        let (_witness, seeds, _fee) = tuple3(body, &da).unwrap();
-        // Walk the seed z-set looking for an empty (atom0) note_data.
-        let mut empty_found = false;
-        let mut stack = vec![seeds];
-        while let Some(s) = stack.pop() {
-            if s == da.atom0() {
-                continue;
-            }
-            if let Some((seed, lr)) = uncons(s, &da) {
-                if let Some((_src, _root, nd, _gift, _parent)) = tuple5(seed, &da) {
-                    if nd == da.atom0() {
-                        empty_found = true;
-                    }
-                }
-                if let Some((left, right)) = uncons(lr, &da) {
-                    stack.push(left);
-                    stack.push(right);
-                }
-            }
-        }
-        assert!(empty_found, "expected an output seed with empty note_data");
-    }
-
-    #[test]
-    fn compose_spends_or_composed_input_branch() {
-        let a = "9yPePjfWAdUnzaQKyxcRXKRa5PpUzKKEwtpECBZsUYt9Jd7egSDEWoV";
-        let b = "9phXGACnW4238oqgvn2gpwaUjG3RAqcxq2Ash2vaKp8KjzSd3MQ56Jt";
-        let commit = hash_to_b58([123u64, 0, 0, 0, 0]);
-
-        let branches = vec![
-            LockBranch {
-                recipient: Some(RecipientInput::Pkh(a.to_string())),
-                timelock: None,
-                hashlock: Some(vec![commit.clone()]),
-                burn: false,
-            },
-            LockBranch {
-                recipient: Some(RecipientInput::Pkh(b.to_string())),
-                timelock: Some(TimelockSpec {
-                    rel_min: None,
-                    rel_max: None,
-                    abs_min: Some(80_000),
-                    abs_max: None,
-                }),
-                hashlock: None,
-                burn: false,
-            },
-        ];
-
-        // Derive the input note name from the OR lock root.
-        let mut arena = Arena::new();
-        let ctx = test_ctx(&mut arena);
-        let (_lock, root, _wit, _signers) = build_or_input(&mut arena, &branches, 0, &ctx).unwrap();
-        let note_first = compute_first_name_from_lock_hash(root, &ctx).unwrap();
-
-        let composed = compose_tx_v1_unsigned_inner(ComposeTxV1Input {
-            source_pkh: a.to_string(),
-            notes: vec![NoteInput {
-                name_first: hash_to_b58(note_first),
-                name_last: a.to_string(),
-                origin_page: 1,
-                assets: 100_000_000,
-                version: 1,
-            }],
-            outputs: vec![OutputInput {
-                recipient: RecipientInput::Pkh(a.to_string()),
-                amount: 65_536,
-                alias: None,
-                timelock: None,
-                hashlock: None,
-                burn: false,
-                lock_root_only: false,
-                or_branches: None,
-            }],
-            coinbase_rel_min: None,
-            current_height: Some(BYTHOS_PHASE),
-            bythos_phase: None,
-            base_fee: None,
-            input_fee_divisor: None,
-            min_fee: None,
-            source_multisig: None,
-            source_or_lock: Some(OrSourceInput {
-                branches: branches.clone(),
-                spend_branch: 0,
-            }),
-        })
-        .expect("compose OR-input spend");
-
-        // Decode the witness's lock-merkle-proof and verify it against the root.
-        let mut da = Arena::new();
-        let tx = cue(&composed.wallet_jam, &mut da).unwrap();
-        let (_t, _n, spends, _d, _w) = tuple5(tx, &da).unwrap();
-        let (node, _l, _r) = decompose_map(spends, &da).unwrap();
-        let (_name, spend) = decompose_pair(node, &da).unwrap();
-        let (_tag, body) = tuple2(spend, &da).unwrap();
-        let (witness, _seeds, _fee) = tuple3(body, &da).unwrap();
-        let (lmp, _pkh, _hax, _tim) = tuple4(witness, &da).unwrap();
-        // Full lmp: [%full spend-condition axis [root path]].
-        let (ver, sc, axis_noun, merk) = tuple4(lmp, &da).unwrap();
-        assert!(da.atom_eq_bytes(
-            match ver {
-                Noun::Atom(id) => id,
-                _ => panic!("version not atom"),
-            },
-            LOCK_MERKLE_PROOF_FULL_TAG
-        ));
-        let axis = noun_atom_u64(axis_noun, &da).unwrap();
-        let (root_noun, path_noun) = tuple2(merk, &da).unwrap();
-        let proof_root = parse_hash(root_noun, &da).unwrap();
-        assert_eq!(proof_root, root);
-        // Collect path hashes and verify the spend-condition hashes to the root.
-        let mut path = Vec::new();
-        let mut cur = path_noun;
-        while cur != da.atom0() {
-            let (h, t) = uncons(cur, &da).unwrap();
-            path.push(parse_hash(h, &da).unwrap());
-            cur = t;
-        }
-        let leaf_hash = hash_lock_primitives_list(sc, &da, &ctx).unwrap();
-        let verified = merk_verify_root(leaf_hash, axis, &path).unwrap();
-        assert_eq!(verified, Some(root));
-    }
-
-    #[test]
-    fn lock_merkle_proof_round_trips_to_canonical_root() {
-        let mut arena = Arena::new();
-        let ctx = test_ctx(&mut arena);
-        let a = parse_b58_hash("9yPePjfWAdUnzaQKyxcRXKRa5PpUzKKEwtpECBZsUYt9Jd7egSDEWoV").unwrap();
-        let b = parse_b58_hash("9phXGACnW4238oqgvn2gpwaUjG3RAqcxq2Ash2vaKp8KjzSd3MQ56Jt").unwrap();
-
-        // Build leaf spend-condition hashes for a few tree shapes.
-        let sc_hash = |arena: &mut Arena, prim: Noun, ctx: &TxIdCtx| -> [u64; 5] {
-            let sc = build_list(arena, &[prim]);
-            hash_lock_primitives_list(sc, arena, ctx).unwrap()
-        };
-
-        for size in [2usize, 4] {
-            // Distinct leaves: pkh(A), tim, [hax, burn padding...] as needed.
-            let mut leaves = Vec::new();
-            let pkh = build_pkh_lock(&mut arena, a);
-            leaves.push(sc_hash(&mut arena, pkh.unwrap(), &ctx));
-            let tim = build_tim_lock_full(&mut arena, Some(3), Some(10), Some(20), None);
-            leaves.push(sc_hash(&mut arena, tim, &ctx));
-            while leaves.len() < size {
-                let hax = build_hax_lock(&mut arena, &[a, b]).unwrap();
-                leaves.push(sc_hash(&mut arena, hax, &ctx));
-            }
-
-            let expected_root = hash_lock_tree_root(&mut arena, &leaves, size).unwrap();
-            let tree = or_hashable_tree(&mut arena, &leaves, size);
-
-            for leaf_number in 1..=size as u64 {
-                // hashable index = leaf_number + 1 (the tag occupies leaf 1).
-                let (prove_root, path, axis) = htree_prove(&tree, leaf_number + 1).unwrap();
-                assert_eq!(prove_root, expected_root, "prove root (size {size}, leaf {leaf_number})");
-                // The chain verifier reconstructs the same root from this leaf's
-                // spend-condition hash + the proof.
-                let leaf_hash = leaves[(leaf_number - 1) as usize];
-                let verified = merk_verify_root(leaf_hash, axis, &path).unwrap();
-                assert_eq!(
-                    verified,
-                    Some(expected_root),
-                    "verify (size {size}, leaf {leaf_number}, axis {axis})"
-                );
-            }
-        }
-    }
-
-    #[test]
-    fn or_lock_root_matches_spec_formula() {
-        let a = "9yPePjfWAdUnzaQKyxcRXKRa5PpUzKKEwtpECBZsUYt9Jd7egSDEWoV";
-        let b = hash_to_b58([42u64, 0, 0, 0, 0]);
-
-        let mut arena = Arena::new();
-        let ctx = tx_id_ctx(&mut arena).expect("tx id ctx");
-
-        // Two branches: a plain pkh and a timelocked pkh.
-        let branches = vec![
-            LockBranch {
-                recipient: Some(RecipientInput::Pkh(a.to_string())),
-                timelock: None,
-                hashlock: None,
-                burn: false,
-            },
-            LockBranch {
-                recipient: Some(RecipientInput::Pkh(b.clone())),
-                timelock: Some(TimelockSpec {
-                    rel_min: None,
-                    rel_max: None,
-                    abs_min: Some(50_000),
-                    abs_max: None,
-                }),
-                hashlock: None,
-                burn: false,
-            },
-        ];
-        let (_lock, root) = build_or_lock(&mut arena, &branches, &ctx).unwrap();
-
-        // Recompute the expected root independently: each branch's
-        // spend-condition hash, then hash-pair(leaf(2), hash-pair(h_a, h_b)).
-        let (sc_a, _) = build_spend_condition(
-            &mut arena,
-            Some(&RecipientInput::Pkh(a.to_string())),
-            None,
-            None,
-            false,
-            &ctx,
-        )
-        .unwrap();
-        let (sc_b, _) = build_spend_condition(
-            &mut arena,
-            Some(&RecipientInput::Pkh(b.clone())),
-            Some(&TimelockSpec {
-                rel_min: None,
-                rel_max: None,
-                abs_min: Some(50_000),
-                abs_max: None,
-            }),
-            None,
-            false,
-            &ctx,
-        )
-        .unwrap();
-        let h_a = hash_lock_primitives_list(sc_a, &arena, &ctx).unwrap();
-        let h_b = hash_lock_primitives_list(sc_b, &arena, &ctx).unwrap();
-        let tag2 = arena.alloc_atom_u64(2);
-        let tag2_digest = hash_noun_varlen(tag2, &arena).unwrap();
-        let pair = hash_ten_cell(h_a, h_b).unwrap();
-        let expected = hash_ten_cell(tag2_digest, pair).unwrap();
-        assert_eq!(root, expected);
-
-        // Three branches pad to a %4 tree (≠ the 2-branch root).
-        let three = vec![
-            branches[0].clone(),
-            branches[1].clone(),
-            LockBranch {
-                recipient: None,
-                timelock: None,
-                hashlock: None,
-                burn: true,
-            },
-        ];
-        let (_l3, root3) = build_or_lock(&mut arena, &three, &ctx).unwrap();
-        assert_ne!(root, root3);
-    }
-
-    #[test]
-    fn wallet_tx_v1_uses_full_lock_merkle_proof_for_bythos_notes() {
-        let source_pkh_b58 = "9yPePjfWAdUnzaQKyxcRXKRa5PpUzKKEwtpECBZsUYt9Jd7egSDEWoV";
-        let source_pkh = parse_b58_hash(source_pkh_b58).expect("source pkh");
-
-        let mut arena = Arena::new();
-        let ctx = tx_id_ctx(&mut arena).expect("tx id ctx");
-
-        let simple_pkh = build_pkh_lock(&mut arena, source_pkh).expect("lock primitive");
-        let simple_lock = build_list(&mut arena, &[simple_pkh]);
-        let simple_lock_hash =
-            hash_lock_primitives_list(simple_lock, &arena, &ctx).expect("lock hash");
-        let note_first =
-            compute_first_name_from_lock_hash(simple_lock_hash, &ctx).expect("first name");
-
-        let composed = compose_tx_v1_unsigned_inner(ComposeTxV1Input {
-            source_pkh: source_pkh_b58.to_string(),
-            notes: vec![NoteInput {
-                name_first: hash_to_b58(note_first),
-                name_last: source_pkh_b58.to_string(),
-                origin_page: BYTHOS_PHASE,
-                assets: 100_000_000,
-                version: 1,
-            }],
-            outputs: vec![OutputInput {
-                recipient: RecipientInput::Pkh(source_pkh_b58.to_string()),
-                amount: 65_536,
-                alias: None,
-                timelock: None,
-                hashlock: None,
-                burn: false,
-                lock_root_only: false,
-                or_branches: None,
-            }],
-            coinbase_rel_min: None,
-            current_height: Some(BYTHOS_PHASE),
-            bythos_phase: None,
-            base_fee: None,
-            input_fee_divisor: None,
-            min_fee: None,
-            source_multisig: None,
-            source_or_lock: None,
-        })
-        .expect("compose");
-
-        let mut decode_arena = Arena::new();
-        let tx_noun = tx_types::pokenoun::cue(&composed.wallet_jam, &mut decode_arena)
-            .expect("cue wallet tx");
-        let (_tag, _name, _spends, _display, witness_data) =
-            tuple5(tx_noun, &decode_arena).expect("wallet tx tuple5");
-        let (_wd_tag, wd_map) = tuple2(witness_data, &decode_arena).expect("witness-data tuple2");
-
-        let witness = first_zmap_value(wd_map, &decode_arena);
-        let (lmp, _pkh, _hax, _tim) = tuple4(witness, &decode_arena).expect("witness tuple4");
-        let (version, _spend_condition, axis, _proof) =
-            decompose_lock_merkle_proof(lmp, &decode_arena).expect("full lmp");
-
-        let version = version.expect("full lmp version tag");
-        match version {
-            Noun::Atom(atom) => {
-                assert!(decode_arena.atom_eq_bytes(atom, LOCK_MERKLE_PROOF_FULL_TAG))
-            }
-            _ => panic!("expected full lmp version atom"),
-        }
-        assert_eq!(noun_atom_u64(axis, &decode_arena), Some(1));
-    }
-
-    #[test]
-    fn wallet_tx_v1_allocates_exact_minimum_fee() {
-        let source_pkh_b58 = "9yPePjfWAdUnzaQKyxcRXKRa5PpUzKKEwtpECBZsUYt9Jd7egSDEWoV";
-        let source_pkh = parse_b58_hash(source_pkh_b58).expect("source pkh");
-
-        let mut arena = Arena::new();
-        let ctx = tx_id_ctx(&mut arena).expect("tx id ctx");
-
-        let simple_pkh = build_pkh_lock(&mut arena, source_pkh).expect("lock primitive");
-        let simple_lock = build_list(&mut arena, &[simple_pkh]);
-        let simple_lock_hash =
-            hash_lock_primitives_list(simple_lock, &arena, &ctx).expect("lock hash");
-        let note_first =
-            compute_first_name_from_lock_hash(simple_lock_hash, &ctx).expect("first name");
-
-        let input_assets = 100_000_000;
-        let output_amount = 65_536;
-        let composed = compose_tx_v1_unsigned_inner(ComposeTxV1Input {
-            source_pkh: source_pkh_b58.to_string(),
-            notes: vec![NoteInput {
-                name_first: hash_to_b58(note_first),
-                name_last: source_pkh_b58.to_string(),
-                origin_page: BYTHOS_PHASE,
-                assets: input_assets,
-                version: 1,
-            }],
-            outputs: vec![OutputInput {
-                recipient: RecipientInput::Pkh(source_pkh_b58.to_string()),
-                amount: output_amount,
-                alias: None,
-                timelock: None,
-                hashlock: None,
-                burn: false,
-                lock_root_only: false,
-                or_branches: None,
-            }],
-            coinbase_rel_min: None,
-            current_height: Some(BYTHOS_PHASE),
-            bythos_phase: None,
-            base_fee: None,
-            input_fee_divisor: None,
-            min_fee: None,
-            source_multisig: None,
-            source_or_lock: None,
-        })
-        .expect("compose");
-
-        let summary: serde_json::Value =
-            serde_json::from_str(&composed.summary_json).expect("summary json");
-        let total_fees = summary["total_fees"].as_u64().expect("total_fees");
-        let minimum_fee = summary["minimum_fee"].as_u64().expect("minimum_fee");
-        let refund = summary["spends"][0]["refund"].as_u64().expect("refund");
-
-        assert_eq!(total_fees, minimum_fee);
-        assert_eq!(refund, input_assets - output_amount - total_fees);
-
-        let mut decode_arena = Arena::new();
-        let tx_noun = tx_types::pokenoun::cue(&composed.wallet_jam, &mut decode_arena)
-            .expect("cue wallet tx");
-        let (_tag, _name, spends, _display, _witness_data) =
-            tuple5(tx_noun, &decode_arena).expect("wallet tx tuple5");
-        let spend = first_zmap_value(spends, &decode_arena);
-        let (version, body) = tuple2(spend, &decode_arena).expect("spend tuple2");
-        assert_eq!(noun_atom_u64(version, &decode_arena), Some(1));
-        let (_witness, _seeds, fee) = tuple3(body, &decode_arena).expect("spend body");
-        assert_eq!(noun_atom_u64(fee, &decode_arena), Some(total_fees));
+    #[test]
+    fn tagged_source_requires_preimages_and_preserves_the_full_change_lock() {
+        let bytes = 42u64.to_jam().unwrap();
+        let commitment = tx_types::hash_hashable(
+            &UntypedNoun {
+                p: bytes.clone().into(),
+            }
+            .to_hashable()
+            .unwrap(),
+        )
+        .unwrap();
+        let branches: Vec<LockBranch> = serde_json::from_value(json!([
+            {"recipient": A, "hashlock": [commitment.to_b58()]},
+            {"recipient": B, "timelock": {"abs_min": 70000}}
+        ]))
+        .unwrap();
+        let lock = branch_lock(&branches).unwrap();
+        let mut request = input();
+        request.source_or_lock = Some(OrSourceInput {
+            branches,
+            spend_branch: 0,
+            preimages: vec![],
+        });
+        request.notes[0].name_first = NName::first_v1(lock.hash()).to_b58();
+        request.notes[0].note_data = json!({});
+        assert!(compose(request.clone(), SelectionOrder::Descending).is_err());
+        request
+            .source_or_lock
+            .as_mut()
+            .unwrap()
+            .preimages
+            .push(bytes);
+        let result = compose(request.clone(), SelectionOrder::Descending).unwrap();
+        let raw = RawTransactionV1::from_jam(&result.raw_jam).unwrap();
+        let SpendBody::V1(body) = &raw.spends.map.tap()[0].1.body else {
+            panic!()
+        };
+        assert_eq!(body.witness.lmp.axis(), 6);
+        assert!(body
+            .witness
+            .lmp
+            .check(&hash(&request.notes[0].name_first).unwrap()));
+        assert!(body
+            .seeds
+            .set
+            .tap()
+            .iter()
+            .any(|seed| seed.lock_root == lock.hash()
+                && seed.note_data.to_jam().unwrap()
+                    == NoteData::from_lock(lock.clone()).unwrap().to_jam().unwrap()));
+        request.source_or_lock.as_mut().unwrap().spend_branch = 1;
+        assert!(compose(request.clone(), SelectionOrder::Descending).is_err());
+        request.current_height = Some(70000);
+        assert!(compose(request, SelectionOrder::Descending).is_ok());
     }
 
     #[test]
-    fn note_data_fee_words_are_two_per_entry_plus_terminal() {
-        let mut arena = Arena::new();
-        let null = arena.atom0();
-        let k1 = arena.alloc_atom_bytes(b"lock");
-        let v1 = arena.alloc_atom_u64(1);
-        let k2 = arena.alloc_atom_bytes(b"memo");
-        let v2 = arena.alloc_atom_u64(2);
-        let map = canonical_zmap_put(&mut arena, null, k1, v1).expect("put");
-        let map = canonical_zmap_put(&mut arena, map, k2, v2).expect("put");
-
-        assert_eq!(count_note_data_words(map, &arena).expect("words"), 5);
-        // The z-map noun itself (Hoon's rep accumulator minus keys) is 3n+1.
-        assert_eq!(count_leaves(map, &arena), 7);
-        assert_eq!(count_note_data_words(null, &arena).expect("empty"), 1);
+    fn merger_rejects_different_authorized_spends() {
+        let a = compose(input(), SelectionOrder::Descending).unwrap();
+        let merged = merge(&a.wallet_jam, &a.wallet_jam).unwrap();
+        assert_eq!(merged, a.wallet_jam);
+        let mut request = input();
+        request.outputs[0].amount += 1;
+        let b = compose(request, SelectionOrder::Descending).unwrap();
+        assert!(merge(&a.wallet_jam, &b.wallet_jam).is_err());
+        let mut request = input();
+        request.notes[0].name_last = A.into();
+        let b = compose(request, SelectionOrder::Descending).unwrap();
+        assert!(merge(&a.wallet_jam, &b.wallet_jam).is_err());
     }
 }
diff --git a/nockster-esp/src-tauri/Cargo.toml b/nockster-esp/src-tauri/Cargo.toml
index 209d003..ad47e93 100644
--- a/nockster-esp/src-tauri/Cargo.toml
+++ b/nockster-esp/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "nockster-pc"
-version = "0.2.1"
+version = "0.3.0"
 description = "Management app for Nockster hardware wallet"
 authors = ["Southwestern Pool Supply Co"]
 edition = "2021"
diff --git a/nockster-esp/src-tauri/tauri.conf.json b/nockster-esp/src-tauri/tauri.conf.json
index c6b5264..c6ec6d1 100644
--- a/nockster-esp/src-tauri/tauri.conf.json
+++ b/nockster-esp/src-tauri/tauri.conf.json
@@ -1,12 +1,12 @@
 {
   "productName": "Nockster",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "identifier": "io.swps.nockster",
   "build": {
     "beforeDevCommand": "cd web && npm run dev",
     "devUrl": "http://localhost:3000",
     "beforeBuildCommand": "cd .. && make web",
-    "frontendDist": "web/dist"
+    "frontendDist": "../web/dist"
   },
   "app": {
     "withGlobalTauri": false,
diff --git a/nockster-esp/web/package-lock.json b/nockster-esp/web/package-lock.json
index 7db715e..e22cca7 100644
--- a/nockster-esp/web/package-lock.json
+++ b/nockster-esp/web/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "nockster-web",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "nockster-web",
-      "version": "0.1.0",
+      "version": "0.3.0",
       "dependencies": {
         "@scure/bip39": "^2.0.1",
         "@tauri-apps/api": "^2.8.0",
diff --git a/nockster-esp/web/package.json b/nockster-esp/web/package.json
index 58fdbc9..5f59dea 100644
--- a/nockster-esp/web/package.json
+++ b/nockster-esp/web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "nockster-web",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/nockster-esp/web/src/composer/Composer.tsx b/nockster-esp/web/src/composer/Composer.tsx
index 6f07568..21c7de0 100644
--- a/nockster-esp/web/src/composer/Composer.tsx
+++ b/nockster-esp/web/src/composer/Composer.tsx
@@ -151,6 +151,9 @@ export function Composer({
     nameFirst: '',
     nameLast: '',
     originPage: '',
+    noteData: '{}',
+    currentHeight: '',
+    preimages: '',
     assets: '',
     claimRecipient: '',
     commitment: '',
@@ -189,6 +192,8 @@ export function Composer({
   const [noteFormFirst, setNoteFormFirst] = useState('');
   const [noteFormLast, setNoteFormLast] = useState('');
   const [noteFormOriginPage, setNoteFormOriginPage] = useState('');
+  const [noteFormData, setNoteFormData] = useState('{}');
+  const [candidateHeight, setCandidateHeight] = useState('');
   const [noteFormAssets, setNoteFormAssets] = useState('');
   const [noteFormError, setNoteFormError] = useState<string | null>(null);
   const [quickRecipient, setQuickRecipient] = useState('');
@@ -1005,6 +1010,7 @@ export function Composer({
           updateNodeData(nodeId, { composing: true, lastError: undefined });
           try {
             const result = compose_tx_v1_unsigned({
+              current_height: candidateHeight ? Number(candidateHeight) : undefined,
               source_pkh: entry.address,
               // Spending from a multisig source: inputs are reconstructed as
               // multisig and the .psnt round-trips through each co-signer.
@@ -1013,6 +1019,7 @@ export function Composer({
                   ? { m: entry.multisig.m, pkhs: entry.multisig.pkhs }
                   : undefined,
               notes: inputNotes.map((n) => ({
+                note_data: n.noteData,
                 name_first: n.nameFirst,
                 name_last: n.nameLast,
                 origin_page: n.originPage,
@@ -1047,7 +1054,7 @@ export function Composer({
         },
       });
     },
-    [canSignDraft, nodes, onSignDraft, signDraftDisabledReason, signingDraft, updateNodeData, wasmReady]
+    [candidateHeight, canSignDraft, nodes, onSignDraft, signDraftDisabledReason, signingDraft, updateNodeData, wasmReady]
   );
 
   useEffect(() => {
@@ -1201,12 +1208,14 @@ export function Composer({
       try {
         setQuickStatus('composing...');
         const result = compose_tx_v1_unsigned({
+          current_height: candidateHeight ? Number(candidateHeight) : undefined,
           source_pkh: quickSourceEntry.address,
           source_multisig:
             quickSourceEntry.kind === 'multisig' && quickSourceEntry.multisig
               ? { m: quickSourceEntry.multisig.m, pkhs: quickSourceEntry.multisig.pkhs }
               : undefined,
           notes: notes.map((note) => ({
+            note_data: note.noteData,
             name_first: note.nameFirst,
             name_last: note.nameLast,
             origin_page: note.originPage,
@@ -1258,6 +1267,7 @@ export function Composer({
       quickAmount,
       quickRecipient,
       quickSourceEntry,
+      candidateHeight,
       signDraftDisabledReason,
       wasmReady,
     ]
@@ -1346,7 +1356,7 @@ export function Composer({
     setHtlcStatus('');
     setHtlcDraft(null);
     const fields: Array<[string, string]> = [
-      ['source/change address', htlc.sourceAddr],
+      ['signing address', htlc.sourceAddr],
       ['claim recipient', htlc.claimRecipient],
       ['claim commitment', htlc.commitment],
       ['refund address', htlc.refundAddr],
@@ -1361,6 +1371,10 @@ export function Composer({
     const originPage = Number(htlc.originPage.trim());
     const assets = Number(htlc.assets.trim());
     const refundHeight = Number(htlc.refundHeight.trim());
+    if (!htlc.currentHeight.trim() || !Number.isSafeInteger(Number(htlc.currentHeight)) || Number(htlc.currentHeight) < 0) {
+      setHtlcStatus('Enter the current block height');
+      return;
+    }
     if (![originPage, assets].every((n) => Number.isInteger(n) && n >= 0)) {
       setHtlcStatus('note origin-page and assets must be whole numbers');
       return;
@@ -1385,9 +1399,12 @@ export function Composer({
       ];
       const result = compose_tx_v1_unsigned({
         source_pkh: htlc.sourceAddr.trim(),
-        source_or_lock: { branches, spend_branch: htlc.branch === 'claim' ? 0 : 1 },
+        current_height: Number(htlc.currentHeight),
+        source_or_lock: { branches, spend_branch: htlc.branch === 'claim' ? 0 : 1,
+          preimages: htlc.preimages.trim().split(/\s+/).filter(Boolean).map(value => Array.from(atob(value), ch => ch.charCodeAt(0))) },
         notes: [
           {
+            note_data: JSON.parse(htlc.noteData),
             name_first: htlc.nameFirst.trim(),
             name_last: htlc.nameLast.trim(),
             origin_page: originPage,
@@ -1527,7 +1544,13 @@ export function Composer({
       return;
     }
 
+    let noteData: Record<string, unknown>;
+    try {
+      noteData = JSON.parse(noteFormData);
+      if (!noteData || typeof noteData !== 'object' || Array.isArray(noteData)) throw new Error();
+    } catch { setNoteFormError('Enter the on-chain note data as a JSON object'); return; }
     const note: NoteV1 = {
+      noteData,
       id: newId(),
       nameFirst: first,
       nameLast: last,
@@ -1547,7 +1570,7 @@ export function Composer({
     setNoteFormAssets('');
     setNoteFormError(null);
     setNoteAddOpen(false);
-  }, [addressBook, noteFormAssets, noteFormFirst, noteFormLast, noteFormOriginPage, selectedEntry]);
+  }, [addressBook, noteFormAssets, noteFormFirst, noteFormLast, noteFormOriginPage, noteFormData, selectedEntry]);
 
   const removeNote = useCallback(
     (entryId: string, noteId: string) => {
@@ -1864,6 +1887,10 @@ export function Composer({
       <div className={`composer-layout ${sidebarCollapsed ? 'sidebar-collapsed' : ''}`}>
         {!sidebarCollapsed && (
           <div className="composer-sidebar">
+            <label className="composer-field">
+              <span>Current block height</span>
+              <input value={candidateHeight} onChange={(e) => setCandidateHeight(e.target.value)} placeholder="Required for time-locked notes" />
+            </label>
             <div className="composer-sidebar-header">
               <div className="composer-sidebar-title">Composer</div>
               <div className="composer-row composer-sidebar-tools">
@@ -2220,10 +2247,13 @@ export function Composer({
                 </div>
                 {(
                   [
-                    ['sourceAddr', 'your address (change / refund-to)'],
+                    ['sourceAddr', 'your signing address'],
                     ['nameFirst', 'note name (first hash)'],
                     ['nameLast', 'note name (last hash)'],
                     ['originPage', 'note origin page'],
+                    ['noteData', 'on-chain note data (JSON; {} for an empty map)'],
+                    ['currentHeight', 'current block height'],
+                    ['preimages', 'claim preimages (base64 JAM, separated by spaces)'],
                     ['assets', 'note assets (nicks)'],
                     ['claimRecipient', 'HTLC claim recipient (pkh)'],
                     ['commitment', 'HTLC claim commitment (hash)'],
@@ -2538,6 +2568,10 @@ export function Composer({
                   >
                     <summary className="composer-subsummary">Add note</summary>
                     <div className="composer-subbody">
+                      <label className="composer-field">
+                        <span>On-chain note data (JSON; {'{}'} for an empty map)</span>
+                        <textarea value={noteFormData} onChange={(e) => setNoteFormData(e.target.value)} />
+                      </label>
                       <input
                         className="node-input"
                         placeholder="name_first (base58)"
diff --git a/nockster-esp/web/src/composer/nockblocks.ts b/nockster-esp/web/src/composer/nockblocks.ts
index 72b7d0e..f74ed12 100644
--- a/nockster-esp/web/src/composer/nockblocks.ts
+++ b/nockster-esp/web/src/composer/nockblocks.ts
@@ -108,6 +108,7 @@ function normalizeNote(raw: unknown): NoteV1 | null {
   return {
     id: `${nameFirst}:${nameLast}:${originPage}`,
     nameFirst,
+    noteData: valueObject(obj.noteData) ?? undefined,
     nameLast,
     originPage,
     assets,
diff --git a/nockster-esp/web/src/composer/storage.ts b/nockster-esp/web/src/composer/storage.ts
index 68e115d..b5114d4 100644
--- a/nockster-esp/web/src/composer/storage.ts
+++ b/nockster-esp/web/src/composer/storage.ts
@@ -65,6 +65,7 @@ export function loadAddressBook(): AddressBookEntry[] {
           const note: NoteV1 = {
             id: noteId,
             nameFirst,
+            noteData: n.noteData,
             nameLast,
             originPage,
             assets,
diff --git a/nockster-esp/web/src/composer/types.ts b/nockster-esp/web/src/composer/types.ts
index 79a4664..f5bebe9 100644
--- a/nockster-esp/web/src/composer/types.ts
+++ b/nockster-esp/web/src/composer/types.ts
@@ -1,4 +1,5 @@
 export type NoteV1 = {
+  noteData?: Record<string, unknown>;
   id: string;
   nameFirst: string; // base58 hash
   nameLast: string; // base58 hash
diff --git a/packages/wallet-engine/Cargo.lock b/packages/wallet-engine/Cargo.lock
index 1ed11d7..13dfa9d 100644
--- a/packages/wallet-engine/Cargo.lock
+++ b/packages/wallet-engine/Cargo.lock
@@ -651,7 +651,7 @@ dependencies = [
 [[package]]
 name = "ibig"
 version = "0.3.6"
-source = "git+https://github.com/swpsco/tx-types?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "cfg-if",
  "num-traits",
@@ -931,12 +931,12 @@ dependencies = [
 [[package]]
 name = "murmur3"
 version = "0.5.2"
-source = "git+https://github.com/swpsco/tx-types?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 
 [[package]]
 name = "nockapp"
 version = "0.1.0"
-source = "git+https://github.com/swpsco/tx-types?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "bincode",
  "bitvec",
@@ -975,7 +975,7 @@ dependencies = [
 [[package]]
 name = "nockchain-libp2p-io"
 version = "0.1.0"
-source = "git+https://github.com/swpsco/tx-types?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "bs58",
  "ibig",
@@ -987,7 +987,7 @@ dependencies = [
 [[package]]
 name = "nockchain-math"
 version = "0.1.0"
-source = "git+https://github.com/swpsco/tx-types?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "arrayref",
  "bs58",
@@ -1009,7 +1009,7 @@ dependencies = [
 
 [[package]]
 name = "nockster-core"
-version = "0.1.0"
+version = "0.2.0"
 dependencies = [
  "argon2",
  "base64",
@@ -1042,7 +1042,7 @@ dependencies = [
 [[package]]
 name = "nockvm"
 version = "0.1.0"
-source = "git+https://github.com/swpsco/tx-types?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "autotools",
  "bitvec",
@@ -1068,7 +1068,7 @@ dependencies = [
 [[package]]
 name = "nockvm_macros"
 version = "0.1.0"
-source = "git+https://github.com/swpsco/tx-types?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "quote",
  "syn",
@@ -1077,7 +1077,7 @@ dependencies = [
 [[package]]
 name = "noun-serde"
 version = "0.1.0"
-source = "git+https://github.com/swpsco/tx-types?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "nockapp",
  "nockvm",
@@ -1089,7 +1089,7 @@ dependencies = [
 [[package]]
 name = "noun-serde-derive"
 version = "0.1.0"
-source = "git+https://github.com/swpsco/tx-types?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "nockvm",
  "proc-macro2",
@@ -1195,8 +1195,8 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "pokenoun"
-version = "0.1.0"
-source = "git+https://github.com/swpsco/tx-types?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+version = "0.2.0"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 
 [[package]]
 name = "poly1305"
@@ -1836,10 +1836,11 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "tx-types"
-version = "0.1.0"
-source = "git+https://github.com/swpsco/tx-types?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+version = "0.2.0"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "anyhow",
+ "base64",
  "bip39",
  "bs58",
  "bytes",
@@ -2295,7 +2296,7 @@ dependencies = [
 [[package]]
 name = "zkvm-jetpack"
 version = "0.1.0"
-source = "git+https://github.com/swpsco/tx-types?rev=f225b52c8c5901c782573ffeb34d53c1c58aad52#f225b52c8c5901c782573ffeb34d53c1c58aad52"
+source = "git+https://github.com/SWPSCO/tx-types.git?rev=02d194605c475013745cc65b26f1413cd098932e#02d194605c475013745cc65b26f1413cd098932e"
 dependencies = [
  "bitvec",
  "bs58",
diff --git a/packages/wallet-engine/Cargo.toml b/packages/wallet-engine/Cargo.toml
index 317a7f2..117774f 100644
--- a/packages/wallet-engine/Cargo.toml
+++ b/packages/wallet-engine/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "nockster-core"
-version = "0.1.0"
+version = "0.2.0"
 edition = "2021"
 
 [lib]
@@ -10,10 +10,10 @@ crate-type = ["cdylib"]     # good practice for wasm-bindgen targets
 wasm-opt = false
 
 [dependencies]
-tx-types = { git = "https://github.com/swpsco/tx-types", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52", default-features = false, features = ["std", "embedded"] }
-nockapp = { git = "https://github.com/swpsco/tx-types", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52", default-features = false }
-noun-serde = { git = "https://github.com/swpsco/tx-types", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52" }
-nockvm = { git = "https://github.com/swpsco/tx-types", rev = "f225b52c8c5901c782573ffeb34d53c1c58aad52" }
+tx-types = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e", default-features = false, features = ["std", "embedded"] }
+nockapp = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e", default-features = false }
+noun-serde = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e" }
+nockvm = { git = "https://github.com/SWPSCO/tx-types.git", rev = "02d194605c475013745cc65b26f1413cd098932e" }
 nockblocks_api_v0 = { path = "./nockblocks_api_v0" }
 nockblocks_api_v1 = { path = "./nockblocks_api_v1" }
 
diff --git a/packages/wallet-engine/src/planner.rs b/packages/wallet-engine/src/planner.rs
index 81e9386..0aef07a 100644
--- a/packages/wallet-engine/src/planner.rs
+++ b/packages/wallet-engine/src/planner.rs
@@ -1,254 +1,98 @@
-//! Single-signer transaction planning shared by software and hardware wallets.
-use tx_types::transaction_types::{Chal, Sig, F6LT};
-use tx_types::{
-    block_types::build_lock_merkle_proof, lock_data_to_untyped_noun, Coins, Hash, LockData,
-    LockPrimitive, LockPrimitiveBody, NName, NNoteV1, NoteData, Pkh, PkhSignature,
-    PkhSignatureValue, SchnorrPubkey, SchnorrSignature, SeedV1, SeedsV1, Spend, SpendBody,
-    SpendCondition, SpendV1, SpendsV1, Witness, ZMap, ZSet,
+//! Wallet snapshot and output adapters for the shared transaction planner.
+use tx_types::lock_resolver::{LockMatcher, SigningKeyLockMatcher};
+pub(crate) use tx_types::planner::PlannedOutput;
+use tx_types::planner::{
+    self, CandidateVersionPolicy, ChainContext, FeePolicy, PlanRequest, PlanningMode,
+    SelectionMode, SelectionOrder,
 };
+use tx_types::{Hash, NNote, NNoteV1, SpendCondition, SpendsV1};
 
-#[derive(Debug, Clone)]
-pub(crate) struct Output {
-    pub lock_root: Hash,
-    pub note_data: NoteData,
-    pub amount: u64,
+pub(crate) fn matcher(source: &Hash) -> SigningKeyLockMatcher {
+    SigningKeyLockMatcher {
+        signer_pkh: source.clone(),
+        public_key: None,
+        coinbase_relative_min: Some(100),
+    }
 }
 
-pub(crate) fn pkh_lock(pkh: &Hash) -> SpendCondition {
-    SpendCondition {
-        p: vec![LockPrimitive {
-            header: "pkh".into(),
-            body: LockPrimitiveBody::Pkh(Pkh {
-                m: 1,
-                h: ZSet::gas(vec![pkh.clone()]),
-            }),
-        }],
-    }
+pub(crate) fn pkh_lock(source: &Hash) -> SpendCondition {
+    tx_types::lock_resolver::simple_pkh(source.clone())
 }
 
-pub(crate) fn payment(pkh: &Hash, amount: u64, private: bool) -> Output {
-    let lock = pkh_lock(pkh);
-    let mut map = ZMap::new();
-    if !private {
-        map.put(
-            "lock".into(),
-            lock_data_to_untyped_noun(&LockData::V0(lock.clone())),
-        );
-    }
-    Output {
-        lock_root: lock.to_hash(),
-        note_data: NoteData { map },
-        amount,
-    }
+pub(crate) fn payment(source: &Hash, amount: u64, private: bool) -> PlannedOutput {
+    PlannedOutput::payment(source.clone(), amount, private).expect("validated wallet address")
 }
 
-/// Resolve the disclosed lock or a standard payment/coinbase lock and enforce its timelocks.
+#[cfg(test)]
 pub(crate) fn spendable_lock(
     note: &NNoteV1,
     source: &Hash,
     height: Option<u64>,
 ) -> Option<SpendCondition> {
-    let mut lock = pkh_lock(source);
-    if let Some(noun) = note.note_data.map.get(&"lock".into()) {
-        let LockData::V0(disclosed) = noun.to_typed::<LockData>().ok()?;
-        lock = disclosed;
-    } else if note.name.p.first()? != &NName::first_v1(lock.to_hash()) {
-        lock.p.push(LockPrimitive {
-            header: "tim".into(),
-            body: LockPrimitiveBody::Tim(tx_types::Tim {
-                rel: tx_types::TimelockRange {
-                    min: Some(tx_types::PageNumber { value: 100 }),
-                    max: None,
-                },
-                abs: tx_types::TimelockRange {
-                    min: None,
-                    max: None,
-                },
-            }),
-        });
-    }
-    if note.name.p.len() != 2 || note.name.p[0] != NName::first_v1(lock.to_hash()) {
-        return None;
-    }
-    let mut has_key = false;
-    for primitive in &lock.p {
-        match &primitive.body {
-            LockPrimitiveBody::Pkh(pkh) if pkh.m == 1 && pkh.h.wyt() == 1 && pkh.h.has(source) => {
-                has_key = true;
-            }
-            LockPrimitiveBody::Tim(tim) => {
-                let height = height?;
-                let relative = height.checked_sub(note.origin_page.value)?;
-                for (range, value) in [(&tim.rel, relative), (&tim.abs, height)] {
-                    if range.min.as_ref().is_some_and(|min| value < min.value)
-                        || range.max.as_ref().is_some_and(|max| value > max.value)
-                    {
-                        return None;
-                    }
-                }
-            }
-            _ => return None,
-        }
-    }
-    has_key.then_some(lock)
+    let resolved = matcher(source).resolve(note)?;
+    resolved
+        .admits(note, height)
+        .then(|| resolved.spend_condition())
+        .flatten()
+}
+
+pub(crate) fn plan(
+    notes: &[NNoteV1],
+    outputs: &[PlannedOutput],
+    source: &Hash,
+    private: bool,
+    height: Option<u64>,
+    fee: FeePolicy,
+    mode: PlanningMode,
+) -> Result<planner::PlanResult, String> {
+    let candidates: Vec<_> = notes.iter().cloned().map(NNote::V1).collect();
+    let refund = payment(source, 0, private);
+    let chain = ChainContext {
+        candidate_height: height,
+        ..ChainContext::at_height(height.unwrap_or(tx_types::fee::BYTHOS_PHASE))
+    };
+    planner::plan(
+        PlanRequest {
+            candidates: &candidates,
+            outputs,
+            refund: &refund,
+            selection: SelectionMode::Auto,
+            order: SelectionOrder::Descending,
+            version: CandidateVersionPolicy::V1Only,
+            mode,
+            fee,
+            chain,
+        },
+        &matcher(source),
+    )
+    .map_err(|error| error.to_string())
 }
 
-/// Every input balances independently; every seed commits to the full input note.
+#[cfg(test)]
 pub(crate) fn plan_spends(
     notes: &[NNoteV1],
-    outputs: &[Output],
+    outputs: &[PlannedOutput],
     fee: u64,
     source: &Hash,
     private: bool,
     height: Option<u64>,
 ) -> Result<SpendsV1, String> {
-    let total = outputs.iter().try_fold(fee, |sum, output| {
-        sum.checked_add(output.amount)
-            .ok_or("transaction amount overflow")
-    })?;
-    let mut notes = notes.to_vec();
-    notes.sort_by(|a, b| b.assets.value.cmp(&a.assets.value));
-    let mut names = std::collections::HashSet::new();
-    for note in &notes {
-        if !names.insert(note.name.clone()) {
-            return Err("duplicate input note".into());
-        }
-    }
-    notes.retain(|note| spendable_lock(note, source, height).is_some());
-    let available = notes.iter().try_fold(0u64, |sum, note| {
-        sum.checked_add(note.assets.value)
-            .ok_or("input amount overflow")
-    })?;
-    if available < total {
-        return Err("insufficient funds for payments and network fee".into());
-    }
-
-    let mut remaining: Vec<u64> = outputs.iter().map(|o| o.amount).collect();
-    let mut remaining_fee = fee;
-    let mut needed = total;
-    let mut spends = ZMap::new();
-    for note in notes {
-        if needed == 0 {
-            break;
-        }
-        let spend_lock = spendable_lock(&note, source, height)
-            .ok_or_else(|| "selected input note is not spendable".to_string())?;
-        let mut capacity = note.assets.value;
-        let input_fee = capacity.min(remaining_fee);
-        remaining_fee -= input_fee;
-        capacity -= input_fee;
-        let mut allocated: Vec<Output> = Vec::new();
-        for (output, left) in outputs.iter().zip(remaining.iter_mut()) {
-            let amount = capacity.min(*left);
-            if amount > 0 {
-                let mut part = output.clone();
-                part.amount = amount;
-                allocated.push(part);
-                *left -= amount;
-                capacity -= amount;
-            }
-        }
-        needed -= note.assets.value - capacity;
-        if capacity > 0 {
-            allocated.push(payment(source, capacity, private));
-        }
-
-        // Equal seeds are a set element. Merge allocations before constructing the set.
-        let mut merged: Vec<Output> = Vec::new();
-        for output in allocated {
-            if let Some(existing) = merged.iter_mut().find(|o| o.lock_root == output.lock_root) {
-                let existing_hash = existing
-                    .note_data
-                    .to_hash()
-                    .map_err(|err| format!("note-data hash: {err}"))?;
-                let output_hash = output
-                    .note_data
-                    .to_hash()
-                    .map_err(|err| format!("note-data hash: {err}"))?;
-                if existing_hash != output_hash {
-                    return Err("conflicting note data for the same output lock".into());
-                }
-                existing.amount = existing
-                    .amount
-                    .checked_add(output.amount)
-                    .ok_or("output overflow")?;
-            } else {
-                merged.push(output);
-            }
-        }
-        let proof_page = height.unwrap_or(tx_types::fee_calculator::BYTHOS_PHASE);
-        let parent_hash = note
-            .to_hash()
-            .map_err(|err| format!("input note hash: {err}"))?;
-        let seeds = SeedsV1 {
-            set: ZSet::gas(
-                merged
-                    .into_iter()
-                    .map(|output| SeedV1 {
-                        output_source: None,
-                        lock_root: output.lock_root,
-                        note_data: output.note_data,
-                        gift: Coins {
-                            value: output.amount,
-                        },
-                        parent_hash: parent_hash.clone(),
-                    })
-                    .collect::<Vec<_>>(),
-            ),
-        };
-        spends.put(
-            note.name.clone(),
-            Spend {
-                version: 1,
-                body: SpendBody::V1(SpendV1 {
-                    witness: Witness {
-                        lmp: build_lock_merkle_proof(spend_lock, 1, proof_page),
-                        pkh: PkhSignature { map: ZMap::new() },
-                        hax: ZMap::new(),
-                        tim: 0,
-                    },
-                    seeds,
-                    fee: Coins { value: input_fee },
-                }),
-            },
-        );
-    }
-    Ok(SpendsV1 { map: spends })
-}
-
-/// Fee accounting counts noun leaves, so fixed-size signature fields give an exact estimate.
-/// These placeholders are used only for sizing and never enter an exported transaction.
-pub(crate) fn signed_fee(spends: &SpendsV1, source: &Hash) -> u64 {
-    let mut map = ZMap::new();
-    for (name, mut spend) in spends.map.tap() {
-        if let SpendBody::V1(ref mut body) = spend.body {
-            body.witness.pkh.map.put(
-                source.clone(),
-                PkhSignatureValue {
-                    pk: SchnorrPubkey {
-                        x: F6LT { values: [1; 6] },
-                        y: F6LT { values: [1; 6] },
-                        inf: false,
-                    },
-                    sig: SchnorrSignature {
-                        chal: Chal {
-                            values: tx_types::T8 { values: [1; 8] },
-                        },
-                        sig: Sig {
-                            values: tx_types::T8 { values: [1; 8] },
-                        },
-                    },
-                },
-            );
-        }
-        map.put(name, spend);
-    }
-    tx_types::fee_calculator::calculate_min_fee(&map).value
+    plan(
+        notes,
+        outputs,
+        source,
+        private,
+        height,
+        FeePolicy::Exact(fee),
+        PlanningMode::Standard,
+    )
+    .map(|result| result.spends)
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use tx_types::{Coins, LockPrimitive, LockPrimitiveBody, NName, NoteData, SpendBody, ZMap};
     fn hash(n: u64) -> Hash {
         Hash { values: [n; 5] }
     }
@@ -323,7 +167,7 @@ mod tests {
             note(&source, 4, 100),
             note(&source, 5, 100),
         ];
-        let bridge = Output {
+        let bridge = PlannedOutput {
             lock_root: hash(9),
             note_data: NoteData { map: ZMap::new() },
             amount: 150,
diff --git a/packages/wallet-engine/src/tx_engine.rs b/packages/wallet-engine/src/tx_engine.rs
index 8ae9a4b..75e1222 100644
--- a/packages/wallet-engine/src/tx_engine.rs
+++ b/packages/wallet-engine/src/tx_engine.rs
@@ -5,159 +5,39 @@ use nockapp::noun::slab::{NockJammer, NounSlab};
 use nockapp::{NounAllocator, NounSpace};
 use nockblocks_api_v1::models::{note_v1_object::Version as ApiNoteVersion, NoteV1Object};
 use noun_serde::{NounDecode, NounEncode};
-use serde_json::Value as JsonValue;
 use tx_types::{
-    compute_tx_id_v1, lock_data_to_untyped_noun, Coins, Hash, InputV1, Inputs, InputsV1, LockData,
-    LockPrimitive, LockPrimitiveBody, NName, NNote, NNoteV1, NoteData, PageNumber, PkhSignature,
-    Spend, SpendBody, SpendCondition, SpendsV1, Tim, TimelockRange, Transaction, UntypedNoun, ZMap,
-    ZSet,
+    compute_tx_id_v1, Coins, Hash, InputV1, Inputs, InputsV1, LockPrimitive, LockPrimitiveBody,
+    NName, NNote, NNoteV1, NoteData, PageNumber, PkhSignature, Spend, SpendBody, SpendsV1,
+    Transaction, ZMap,
 };
 
 use crate::wallet::Wallet;
 use crate::{TransactionRecipient, BASE_FIELD_PRIME, BRIDGE_LOCK_ROOT, BRIDGE_MINIMUM_NICKS};
 
-const MAX_FEE_ADJUSTMENTS: usize = 32;
-
-/// Convert an EVM address (hex string) to based field elements for noteData.bridge
-/// The EVM address is stored as [%0 [%base addr=evm-address-based]]
-/// where evm-address-based is a triple of base field elements
-///
-/// EVM addresses are 160 bits (20 bytes), so we need to handle them as big integers
-/// by parsing the hex in chunks.
 fn evm_address_to_based(evm_hex: &str) -> Result<[u64; 3], String> {
-    // Remove 0x prefix if present
     let hex = evm_hex.strip_prefix("0x").unwrap_or(evm_hex);
-
-    if hex.len() != 40 {
-        return Err(format!(
-            "invalid EVM address '{}': expected 40 hex characters, got {}",
-            evm_hex,
-            hex.len()
-        ));
+    if hex.len() != 40 || !hex.is_ascii() {
+        return Err("invalid EVM address: expected 40 hexadecimal characters".into());
     }
-
-    // Parse the 160-bit address as bytes
-    if !hex.is_ascii() {
-        return Err("EVM address must be hexadecimal ASCII".into());
+    let mut address = [0u8; 20];
+    for (index, byte) in address.iter_mut().enumerate() {
+        *byte = u8::from_str_radix(&hex[2 * index..2 * index + 2], 16)
+            .map_err(|_| "invalid EVM address")?;
     }
-    let bytes =
-        hex_to_bytes(hex).map_err(|e| format!("invalid EVM address '{}': {}", evm_hex, e))?;
-    if bytes.iter().all(|byte| *byte == 0) {
+    if address == [0; 20] {
         return Err("bridge destination cannot be the zero address".into());
     }
-
-    // Convert bytes to little-endian limbs
-    let mut addr_limbs = [0u64; 3];
-    // bytes is big-endian, we need little-endian
-    let bytes_le: Vec<u8> = bytes.iter().rev().cloned().collect();
-
-    // Pack into u64 limbs (little-endian)
-    for (i, chunk) in bytes_le.chunks(8).enumerate() {
-        if i >= 3 {
-            break;
-        }
-        let mut val = 0u64;
-        for (j, &b) in chunk.iter().enumerate() {
-            val |= (b as u64) << (j * 8);
-        }
-        addr_limbs[i] = val;
-    }
-
-    // Now perform division by p = 2^64 - 2^32 + 1 = 18446744069414584321
-    // to get three based field elements
-    let p = BASE_FIELD_PRIME;
-
-    // Helper: divide [u64; 3] by u128, return (quotient, remainder)
-    fn div_big_by_p(limbs: [u64; 3], p: u128) -> ([u64; 3], u64) {
-        // Convert limbs to 192-bit value and divide
-        // limbs[0] + limbs[1] * 2^64 + limbs[2] * 2^128
-        let mut quot = [0u64; 3];
-        let mut rem = 0u128;
-
-        // Process from most significant limb
-        for i in (0..3).rev() {
-            let cur = (rem << 64) | limbs[i] as u128;
-            quot[i] = (cur / p) as u64;
-            rem = cur % p;
-        }
-
-        (quot, rem as u64)
-    }
-
-    let (q1, a) = div_big_by_p(addr_limbs, p);
-    let (q2, b) = div_big_by_p(q1, p);
-    let (q3, c) = div_big_by_p(q2, p);
-
-    // q3 should be all zeros
-    if q3 != [0, 0, 0] {
-        return Err(format!(
-            "EVM address {} is too large for based encoding",
-            evm_hex
-        ));
-    }
-
-    Ok([a, b, c])
-}
-
-/// Parse a hex string into bytes
-fn hex_to_bytes(hex: &str) -> Result<Vec<u8>, String> {
-    if hex.len() % 2 != 0 {
-        return Err("hex string must have even length".to_string());
-    }
-    (0..hex.len())
-        .step_by(2)
-        .map(|i| {
-            u8::from_str_radix(&hex[i..i + 2], 16)
-                .map_err(|_| format!("invalid hex at position {}", i))
-        })
-        .collect()
-}
-
-/// Struct representing the bridge deposit data: [%0 [%base [a b c]]]
-/// Uses noun_serde for automatic encoding
-#[derive(Clone, Debug, NounEncode, NounDecode)]
-struct BridgeDepositData {
-    /// Version tag: always 0
-    version: u64,
-    /// Bridge type and address
-    body: BridgeDepositBody,
+    Ok(tx_types::note_data::BridgeDepositDataPayload::from_evm_address(address).evm_address_based)
 }
 
-#[derive(Clone, Debug, NounEncode, NounDecode)]
-struct BridgeDepositBody {
-    /// Type tag: "base" as a cord
-    tag: String,
-    /// EVM address as three based field elements
-    addr: (u64, u64, u64),
-}
-
-/// Build noteData for a bridge output containing the EVM destination address
 fn build_bridge_note_data(evm_address: &str) -> Result<NoteData, String> {
-    let based_addr = evm_address_to_based(evm_address)?;
-
-    // Build the bridge data structure matching Hoon: [%0 [%base [a b c]]]
-    let bridge_data = BridgeDepositData {
-        version: 0,
-        body: BridgeDepositBody {
-            tag: "base".to_string(),
-            addr: (based_addr[0], based_addr[1], based_addr[2]),
-        },
+    let payload = tx_types::note_data::BridgeDepositDataPayload {
+        evm_address_based: evm_address_to_based(evm_address)?,
     };
-
-    // Encode to noun and jam it
-    let mut slab = NounSlab::<NockJammer>::new();
-    let noun = bridge_data.to_noun(&mut slab);
-    slab.set_root(noun);
-    let jammed = slab.jam();
-
-    let bridge_noun = UntypedNoun {
-        p: Bytes::from(jammed.to_vec()),
-    };
-
-    let mut note_data_map = ZMap::new();
-    note_data_map.put("bridge".to_string(), bridge_noun);
-
-    Ok(NoteData { map: note_data_map })
+    let mut data = NoteData { map: ZMap::new() };
+    data.insert_bridge_deposit(&payload)
+        .map_err(|error| error.to_string())?;
+    Ok(data)
 }
 
 #[derive(Clone)]
@@ -265,34 +145,17 @@ pub(crate) fn max_payment(
             _ => unreachable!(),
         })
         .collect();
-    let available = notes
-        .iter()
-        .filter(|n| crate::planner::spendable_lock(n, source, options.chain_height).is_some())
-        .try_fold(0u64, |sum, n| {
-            sum.checked_add(n.assets.value).ok_or("balance overflow")
-        })?;
-    let mut fee = tx_types::fee_calculator::MIN_FEE;
-    for _ in 0..MAX_FEE_ADJUSTMENTS {
-        let amount = available
-            .checked_sub(fee)
-            .filter(|amount| *amount > 0)
-            .ok_or("balance does not cover the network fee")?;
-        let output = crate::planner::payment(destination, amount, options.private_outputs);
-        let spends = crate::planner::plan_spends(
-            &notes,
-            &[output],
-            fee,
-            source,
-            options.private_outputs,
-            options.chain_height,
-        )?;
-        let required = crate::planner::signed_fee(&spends, source);
-        if required <= fee {
-            return Ok(amount);
-        }
-        fee = required;
-    }
-    Err("unable to converge on a network fee".into())
+    let destination = crate::planner::payment(destination, 0, options.private_outputs);
+    let result = crate::planner::plan(
+        &notes,
+        &[],
+        source,
+        options.private_outputs,
+        options.chain_height,
+        tx_types::planner::FeePolicy::Minimum,
+        tx_types::planner::PlanningMode::Sweep { destination },
+    )?;
+    Ok(result.selected_total - result.final_fee)
 }
 
 fn plan_transaction(
@@ -314,7 +177,9 @@ fn plan_transaction(
         .collect::<Vec<_>>();
     let mut outputs = convert_recipients(recipients)?;
     if options.private_outputs
-        && outputs.iter().any(|output| output.note_data.map.has(&"bridge".into()))
+        && outputs
+            .iter()
+            .any(|output| output.note_data.map.has(&"bridge".into()))
     {
         return Err("bridge transactions require public outputs".into());
     }
@@ -323,48 +188,16 @@ fn plan_transaction(
             output.note_data.map.del(&"lock".into());
         }
     }
-    let mut fee = tx_types::fee_calculator::MIN_FEE;
-    for _ in 0..MAX_FEE_ADJUSTMENTS {
-        let spends = crate::planner::plan_spends(
-            &notes,
-            &outputs,
-            fee,
-            source,
-            options.private_outputs,
-            options.chain_height,
-        )?;
-        let required = crate::planner::signed_fee(&spends, source);
-        if required <= fee {
-            return Ok((spends, prepared, fee));
-        }
-        let selected_total = notes
-            .iter()
-            .filter(|n| spends.map.has(&n.name))
-            .try_fold(0u64, |sum, n| {
-                sum.checked_add(n.assets.value).ok_or("input overflow")
-            })?;
-        let output_total = outputs.iter().try_fold(0u64, |sum, o| {
-            sum.checked_add(o.amount).ok_or("output overflow")
-        })?;
-        let remainder = selected_total
-            .checked_sub(output_total)
-            .ok_or("insufficient funds")?;
-        if remainder >= tx_types::fee_calculator::MIN_FEE && remainder <= required {
-            let exact = crate::planner::plan_spends(
-                &notes,
-                &outputs,
-                remainder,
-                source,
-                options.private_outputs,
-                options.chain_height,
-            )?;
-            if crate::planner::signed_fee(&exact, source) <= remainder {
-                return Ok((exact, prepared, remainder));
-            }
-        }
-        fee = required;
-    }
-    Err("unable to converge on a network fee".into())
+    let result = crate::planner::plan(
+        &notes,
+        &outputs,
+        source,
+        options.private_outputs,
+        options.chain_height,
+        tx_types::planner::FeePolicy::Minimum,
+        tx_types::planner::PlanningMode::Standard,
+    )?;
+    Ok((result.spends, prepared, result.final_fee))
 }
 
 fn finish_transaction(spends: SpendsV1, fee: u64) -> Result<BuiltTransaction, String> {
@@ -511,72 +344,19 @@ fn convert_note_v1(note: NoteV1Object) -> Result<NNoteV1, String> {
     name_parts.push(first);
     name_parts.push(last);
 
-    let mut note_data_map = ZMap::new();
-    for (key, value) in note.note_data {
-        if key == "lock" {
-            // The API labels inferred spending conditions; they are not on-chain note data.
-            // Parent hashes commit only to the actual input note.
-            if value.get("source").and_then(JsonValue::as_str) == Some("reconstructed") {
-                continue;
-            }
-            if let Some(lock_noun) = lock_value_to_untyped_noun(value)? {
-                note_data_map.put(key, lock_noun);
-            }
-            continue;
-        }
-
-        if let Some(untyped) = base64_json_value_to_untyped_noun(value, &key)? {
-            note_data_map.put(key, untyped);
-        }
-    }
+    let note_data = tx_types::rpc_note_data::note_data_from_json(
+        &serde_json::to_value(note.note_data).map_err(|error| error.to_string())?,
+    )?;
 
     Ok(NNoteV1 {
         version,
         origin_page: PageNumber { value: origin_page },
         name: NName { p: name_parts },
-        note_data: NoteData { map: note_data_map },
+        note_data,
         assets: Coins { value: assets },
     })
 }
 
-fn lock_value_to_untyped_noun(value: JsonValue) -> Result<Option<UntypedNoun>, String> {
-    match value {
-        JsonValue::Null => Ok(None),
-        JsonValue::Object(_) => {
-            let spend_condition = parse_lock_from_json(&value)?;
-            let lock_data = LockData::V0(spend_condition);
-            Ok(Some(lock_data_to_untyped_noun(&lock_data)))
-        }
-        JsonValue::String(encoded) => {
-            let decoded = decode_base64(&encoded, "noteData.lock")?;
-            Ok(Some(UntypedNoun {
-                p: Bytes::from(decoded),
-            }))
-        }
-        other => Err(format!(
-            "noteData.lock must be an object or base64 string, found {other:?}"
-        )),
-    }
-}
-
-fn base64_json_value_to_untyped_noun(
-    value: JsonValue,
-    label: &str,
-) -> Result<Option<UntypedNoun>, String> {
-    match value {
-        JsonValue::Null => Ok(None),
-        JsonValue::String(encoded) => {
-            let decoded = decode_base64(&encoded, &format!("noteData.{label}"))?;
-            Ok(Some(UntypedNoun {
-                p: Bytes::from(decoded),
-            }))
-        }
-        other => Err(format!(
-            "noteData.{label} must be a base64 string, found {other:?}"
-        )),
-    }
-}
-
 pub(crate) fn validate_based_noun(
     noun: nockvm::noun::Noun,
     space: &NounSpace,
@@ -603,26 +383,9 @@ pub(crate) fn validate_based_noun(
     Ok(())
 }
 
-fn decode_base64(encoded: &str, label: &str) -> Result<Vec<u8>, String> {
-    let trimmed = encoded.trim();
-    if trimmed.len() > 1_400_000 {
-        return Err(format!("{label} exceeds size limit"));
-    }
-    let bytes = general_purpose::STANDARD
-        .decode(trimmed)
-        .map_err(|err| format!("failed to decode base64 for {label}: {err}"))?;
-    let mut slab = NounSlab::<NockJammer>::new();
-    let noun = slab
-        .cue_into(Bytes::from(bytes.clone()))
-        .map_err(|e| format!("invalid noun for {label}: {e}"))?;
-    let space = slab.noun_space();
-    validate_based_noun(noun, &space)?;
-    Ok(bytes)
-}
-
 fn convert_recipients(
     recipients: Vec<TransactionRecipient>,
-) -> Result<Vec<crate::planner::Output>, String> {
+) -> Result<Vec<crate::planner::PlannedOutput>, String> {
     if recipients.len() != 1 && recipients.iter().any(|r| r.bridge_evm_address.is_some()) {
         return Err("bridge transactions require one deposit and no additional recipients".into());
     }
@@ -643,7 +406,7 @@ fn convert_recipients(
             if recipient.gift < BRIDGE_MINIMUM_NICKS {
                 return Err("bridge deposit requires at least 100,000 NOCK".into());
             }
-            outputs.push(crate::planner::Output {
+            outputs.push(crate::planner::PlannedOutput {
                 lock_root: Hash::from_b58(BRIDGE_LOCK_ROOT)?,
                 note_data: build_bridge_note_data(&evm)?,
                 amount: recipient.gift,
@@ -669,7 +432,12 @@ pub(crate) fn verify_bridge_intent(
     recipients: Vec<TransactionRecipient>,
     network_fee: u64,
 ) -> Result<(), String> {
-    if recipients.iter().filter(|r| r.bridge_evm_address.is_some()).count() != 1 {
+    if recipients
+        .iter()
+        .filter(|r| r.bridge_evm_address.is_some())
+        .count()
+        != 1
+    {
         return Err("one bridge destination is required".into());
     }
     let expected = convert_recipients(recipients)?;
@@ -689,7 +457,12 @@ pub(crate) fn verify_bridge_intent(
         .map_err(|err| format!("refund note-data hash: {err}"))?;
     let raw = crate::tx_jam::to_raw_tx_jam(transaction)?;
     let mut slab = NounSlab::<NockJammer>::new();
-    let noun = slab.cue_into(Bytes::from(general_purpose::STANDARD.decode(raw).map_err(|e| e.to_string())?))
+    let noun = slab
+        .cue_into(Bytes::from(
+            general_purpose::STANDARD
+                .decode(raw)
+                .map_err(|e| e.to_string())?,
+        ))
         .map_err(|e| e.to_string())?;
     let space = slab.noun_space();
     let raw = tx_types::transaction_types_v1::RawTransactionV1::from_noun(&noun, &space)
@@ -711,20 +484,25 @@ pub(crate) fn verify_bridge_intent(
                 .note_data
                 .to_hash()
                 .map_err(|err| format!("seed note-data hash: {err}"))?;
-            if let Some(index) = expected
-                .iter()
-                .enumerate()
-                .position(|(i, output)| {
-                    output.lock_root == seed.lock_root && expected_hashes[i] == seed_hash
-                })
-            {
-                totals[index] = totals[index].checked_add(seed.gift.value).ok_or("output overflow")?;
+            if let Some(index) = expected.iter().enumerate().position(|(i, output)| {
+                output.lock_root == seed.lock_root && expected_hashes[i] == seed_hash
+            }) {
+                totals[index] = totals[index]
+                    .checked_add(seed.gift.value)
+                    .ok_or("output overflow")?;
             } else if seed.lock_root != refund.lock_root || seed_hash != refund_hash {
-                return Err("transaction contains an unreviewed output or bridge destination".into());
+                return Err(
+                    "transaction contains an unreviewed output or bridge destination".into(),
+                );
             }
         }
     }
-    if fee != network_fee || expected.iter().zip(totals).any(|(output, total)| output.amount != total) {
+    if fee != network_fee
+        || expected
+            .iter()
+            .zip(totals)
+            .any(|(output, total)| output.amount != total)
+    {
         return Err("bridge transaction does not match the reviewed amounts and fee".into());
     }
     Ok(())
@@ -752,160 +530,6 @@ fn decode_wallet_transaction_base64(value: &str) -> Result<WalletTransaction, St
         .map_err(|err| format!("failed to decode wallet transaction noun: {err}"))
 }
 
-fn parse_lock_from_json(value: &JsonValue) -> Result<SpendCondition, String> {
-    let obj = value
-        .as_object()
-        .ok_or_else(|| "noteData.lock must be an object".to_string())?;
-    let version = obj
-        .get("version")
-        .and_then(|v| v.as_u64())
-        .ok_or_else(|| "lock.version missing".to_string())?;
-    if version != 0 {
-        return Err(format!("unsupported lock version: {}", version));
-    }
-    let primitives = obj
-        .get("data")
-        .and_then(|v| v.as_array())
-        .ok_or_else(|| "lock.data missing".to_string())?;
-    if primitives.is_empty() {
-        return Err("lock.data must contain at least one primitive".into());
-    }
-    let mut parsed = Vec::with_capacity(primitives.len());
-    for item in primitives {
-        parsed.push(parse_lock_primitive(item)?);
-    }
-    Ok(SpendCondition { p: parsed })
-}
-
-fn parse_lock_primitive(value: &JsonValue) -> Result<LockPrimitive, String> {
-    let obj = value
-        .as_object()
-        .ok_or_else(|| "lock primitive must be an object".to_string())?;
-    if let Some(pkh_val) = obj.get("pkh") {
-        let body = parse_pkh_body(pkh_val)?;
-        return Ok(LockPrimitive {
-            header: "pkh".to_string(),
-            body: LockPrimitiveBody::Pkh(body),
-        });
-    }
-    if let Some(tim_val) = obj.get("tim") {
-        let body = parse_tim_body(tim_val)?;
-        return Ok(LockPrimitive {
-            header: "tim".to_string(),
-            body: LockPrimitiveBody::Tim(body),
-        });
-    }
-    if let Some(hax_val) = obj.get("hax") {
-        let body = parse_hax_body(hax_val)?;
-        return Ok(LockPrimitive {
-            header: "hax".to_string(),
-            body: LockPrimitiveBody::Hax(body),
-        });
-    }
-    if obj.contains_key("brn") {
-        return Ok(LockPrimitive {
-            header: "brn".to_string(),
-            body: LockPrimitiveBody::Brn(tx_types::transaction_types_v1::Brn { value: 0 }),
-        });
-    }
-    Err("unsupported lock primitive object".into())
-}
-
-fn parse_pkh_body(value: &JsonValue) -> Result<tx_types::transaction_types_v1::Pkh, String> {
-    let obj = value
-        .as_object()
-        .ok_or_else(|| "pkh primitive must be an object".to_string())?;
-    let m = obj
-        .get("m")
-        .and_then(|v| v.as_u64())
-        .ok_or_else(|| "pkh.m missing".to_string())?;
-    let hashes = obj
-        .get("h")
-        .and_then(|v| v.as_array())
-        .ok_or_else(|| "pkh.h missing".to_string())?;
-    if hashes.is_empty() {
-        return Err("pkh.h must contain at least one hash".into());
-    }
-    let mut set = ZSet::new();
-    for entry in hashes {
-        let addr = entry
-            .as_str()
-            .ok_or_else(|| "pkh.h entries must be strings".to_string())?;
-        let hash =
-            parse_hash(addr).map_err(|e| format!("invalid pk hash '{}' in lock: {e}", addr))?;
-        set.put(hash);
-    }
-    Ok(tx_types::transaction_types_v1::Pkh { m, h: set })
-}
-
-fn parse_tim_body(value: &JsonValue) -> Result<Tim, String> {
-    let obj = value
-        .as_object()
-        .ok_or_else(|| "tim primitive must be an object".to_string())?;
-    let rel = obj
-        .get("relative")
-        .map(parse_timelock_range)
-        .transpose()?
-        .unwrap_or(TimelockRange {
-            min: None,
-            max: None,
-        });
-    let abs = obj
-        .get("absolute")
-        .map(parse_timelock_range)
-        .transpose()?
-        .unwrap_or(TimelockRange {
-            min: None,
-            max: None,
-        });
-    Ok(Tim { rel, abs })
-}
-
-fn parse_timelock_range(value: &JsonValue) -> Result<TimelockRange, String> {
-    let obj = value
-        .as_object()
-        .ok_or_else(|| "timelock range must be an object".to_string())?;
-    let min = obj
-        .get("min")
-        .and_then(|v| v.as_i64())
-        .map(|v| {
-            if v < 0 {
-                Err("timelock min must be non-negative".to_string())
-            } else {
-                Ok(PageNumber { value: v as u64 })
-            }
-        })
-        .transpose()?;
-    let max = obj
-        .get("max")
-        .and_then(|v| v.as_i64())
-        .map(|v| {
-            if v < 0 {
-                Err("timelock max must be non-negative".to_string())
-            } else {
-                Ok(PageNumber { value: v as u64 })
-            }
-        })
-        .transpose()?;
-    Ok(TimelockRange { min, max })
-}
-
-fn parse_hax_body(value: &JsonValue) -> Result<tx_types::transaction_types_v1::Hax, String> {
-    let hashes = value
-        .as_array()
-        .ok_or_else(|| "hax primitive must be an array".to_string())?;
-    let mut set = ZSet::new();
-    for entry in hashes {
-        let addr = entry
-            .as_str()
-            .ok_or_else(|| "hax entries must be strings".to_string())?;
-        let hash =
-            parse_hash(addr).map_err(|e| format!("invalid hax hash '{}' in lock: {e}", addr))?;
-        set.put(hash);
-    }
-    Ok(tx_types::transaction_types_v1::Hax { set })
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1027,13 +651,18 @@ mod tests {
                             min: Some(PageNumber { value: 100 }),
                             max: None,
                         },
-                        abs: tx_types::TimelockRange { min: None, max: None },
+                        abs: tx_types::TimelockRange {
+                            min: None,
+                            max: None,
+                        },
                     }),
                 });
                 api_note.first_name = NName::first_v1(lock.to_hash()).to_b58();
                 api_note.is_coinbase = true;
                 api_note.note_data.get_mut("lock").unwrap()["data"]
-                    .as_array_mut().unwrap().push(json!({
+                    .as_array_mut()
+                    .unwrap()
+                    .push(json!({
                         "tim": {"relative": {"min": 100, "max": null},
                                 "absolute": {"min": null, "max": null}}
                     }));
@@ -1047,18 +676,30 @@ mod tests {
                     vec![TransactionRecipient {
                         address: BRIDGE_LOCK_ROOT.into(),
                         gift: 100_000 * 65536,
-                        bridge_evm_address: Some("0x1234567890abcdef1234567890abcdef12345678".into()),
+                        bridge_evm_address: Some(
+                            "0x1234567890abcdef1234567890abcdef12345678".into(),
+                        ),
                     }]
-                } else { sample_recipients() };
+                } else {
+                    sample_recipients()
+                };
                 let built = build_transaction_from_api_with_options(
-                    &wallet, vec![api_note.clone()], recipients,
-                    BuildTxOptions { private_outputs: false, chain_height: Some(153880) },
-                ).unwrap();
+                    &wallet,
+                    vec![api_note.clone()],
+                    recipients,
+                    BuildTxOptions {
+                        private_outputs: false,
+                        chain_height: Some(153880),
+                    },
+                )
+                .unwrap();
                 let tx = decode_wallet_transaction_base64(&built.base64_tx).unwrap();
                 assert_eq!(tx.spends.map.wyt(), 1);
                 for (name, spend) in tx.spends.map.tap() {
                     assert_eq!(name, on_chain.name);
-                    let SpendBody::V1(body) = spend.body else { panic!("expected V1 spend") };
+                    let SpendBody::V1(body) = spend.body else {
+                        panic!("expected V1 spend")
+                    };
                     assert!(body.seeds.set.wyt() > 0);
                     for seed in body.seeds.set.tap() {
                         assert_eq!(seed.parent_hash, on_chain.to_hash().expect("note hash"));
@@ -1263,39 +904,102 @@ mod tests {
         let wallet = Wallet::from_seedphrase(TEST_SEED.into()).unwrap();
         let source = wallet.public_key_hash().unwrap();
         let address = "0xb74f4d97d40f49eaff06c3a9e97907362c9063fa";
-        let recipients = |evm: &str, gift: u64| vec![TransactionRecipient {
-            address: BRIDGE_LOCK_ROOT.into(), gift, bridge_evm_address: Some(evm.into()),
-        }];
-        let tx = build_transaction_from_api(&wallet, vec![sample_large_note()], recipients(address, BRIDGE_MINIMUM_NICKS)).unwrap();
-        verify_bridge_intent(&tx.base64_tx, &source, recipients(address, BRIDGE_MINIMUM_NICKS), tx.fee_paid).unwrap();
-        assert!(verify_bridge_intent(&tx.base64_tx, &source, recipients("0x1111111111111111111111111111111111111111", BRIDGE_MINIMUM_NICKS), tx.fee_paid).is_err());
-        assert!(verify_bridge_intent(&tx.base64_tx, &source, recipients(address, BRIDGE_MINIMUM_NICKS+1), tx.fee_paid).is_err());
-        assert!(verify_bridge_intent(&tx.base64_tx, &source, recipients(address, BRIDGE_MINIMUM_NICKS), tx.fee_paid+1).is_err());
-        assert!(verify_bridge_intent(&tx.base64_tx, &Hash::from_b58(SAMPLE_RECIPIENT).unwrap(), recipients(address, BRIDGE_MINIMUM_NICKS), tx.fee_paid).is_err());
-        assert!(build_transaction_from_api_with_options(&wallet, vec![sample_large_note()], recipients(address, BRIDGE_MINIMUM_NICKS), BuildTxOptions { private_outputs: true, chain_height: None }).is_err());
+        let recipients = |evm: &str, gift: u64| {
+            vec![TransactionRecipient {
+                address: BRIDGE_LOCK_ROOT.into(),
+                gift,
+                bridge_evm_address: Some(evm.into()),
+            }]
+        };
+        let tx = build_transaction_from_api(
+            &wallet,
+            vec![sample_large_note()],
+            recipients(address, BRIDGE_MINIMUM_NICKS),
+        )
+        .unwrap();
+        verify_bridge_intent(
+            &tx.base64_tx,
+            &source,
+            recipients(address, BRIDGE_MINIMUM_NICKS),
+            tx.fee_paid,
+        )
+        .unwrap();
+        assert!(verify_bridge_intent(
+            &tx.base64_tx,
+            &source,
+            recipients(
+                "0x1111111111111111111111111111111111111111",
+                BRIDGE_MINIMUM_NICKS
+            ),
+            tx.fee_paid
+        )
+        .is_err());
+        assert!(verify_bridge_intent(
+            &tx.base64_tx,
+            &source,
+            recipients(address, BRIDGE_MINIMUM_NICKS + 1),
+            tx.fee_paid
+        )
+        .is_err());
+        assert!(verify_bridge_intent(
+            &tx.base64_tx,
+            &source,
+            recipients(address, BRIDGE_MINIMUM_NICKS),
+            tx.fee_paid + 1
+        )
+        .is_err());
+        assert!(verify_bridge_intent(
+            &tx.base64_tx,
+            &Hash::from_b58(SAMPLE_RECIPIENT).unwrap(),
+            recipients(address, BRIDGE_MINIMUM_NICKS),
+            tx.fee_paid
+        )
+        .is_err());
+        assert!(build_transaction_from_api_with_options(
+            &wallet,
+            vec![sample_large_note()],
+            recipients(address, BRIDGE_MINIMUM_NICKS),
+            BuildTxOptions {
+                private_outputs: true,
+                chain_height: None
+            }
+        )
+        .is_err());
     }
 
     #[test]
     fn bridge_rejects_missing_metadata_wrong_lock_and_zero_destination() {
         for (address, evm) in [
             (BRIDGE_LOCK_ROOT, None),
-            (BRIDGE_LOCK_ROOT, Some("0x0000000000000000000000000000000000000000")),
-            ("94qwbi47JzTySWXpNpYkqDDvuTKLdP8mPDdZTZYnphNCLKSWYeEuFdt", Some("0x1234567890abcdef1234567890abcdef12345678")),
+            (
+                BRIDGE_LOCK_ROOT,
+                Some("0x0000000000000000000000000000000000000000"),
+            ),
+            (
+                "94qwbi47JzTySWXpNpYkqDDvuTKLdP8mPDdZTZYnphNCLKSWYeEuFdt",
+                Some("0x1234567890abcdef1234567890abcdef12345678"),
+            ),
         ] {
             assert!(convert_recipients(vec![TransactionRecipient {
-                address: address.into(), gift: BRIDGE_MINIMUM_NICKS,
+                address: address.into(),
+                gift: BRIDGE_MINIMUM_NICKS,
                 bridge_evm_address: evm.map(str::to_owned),
-            }]).is_err());
+            }])
+            .is_err());
         }
         assert!(convert_recipients(vec![
             TransactionRecipient {
-                address: BRIDGE_LOCK_ROOT.into(), gift: BRIDGE_MINIMUM_NICKS,
+                address: BRIDGE_LOCK_ROOT.into(),
+                gift: BRIDGE_MINIMUM_NICKS,
                 bridge_evm_address: Some("0x1234567890abcdef1234567890abcdef12345678".into()),
             },
             TransactionRecipient {
-                address: SAMPLE_RECIPIENT.into(), gift: 1, bridge_evm_address: None,
+                address: SAMPLE_RECIPIENT.into(),
+                gift: 1,
+                bridge_evm_address: None,
             },
-        ]).is_err());
+        ])
+        .is_err());
     }
 
     #[test]
diff --git a/packages/wallet-engine/src/tx_v1.rs b/packages/wallet-engine/src/tx_v1.rs
index 68ce40f..49fc473 100644
--- a/packages/wallet-engine/src/tx_v1.rs
+++ b/packages/wallet-engine/src/tx_v1.rs
@@ -12,8 +12,7 @@ pub fn sign_transaction_v1(
     let mut spends = ZMap::new();
     for (name, mut input) in inputs.map.tap() {
         input.spend.witness.pkh = PkhSignature { map: ZMap::new() };
-        let spend =
-            tx_types::tx_builder_v1::sign_spend_v1(input.spend, key.clone(), pubkey.clone())?;
+        let spend = tx_types::sign_spend_v1(input.spend, key.clone(), pubkey.clone())?;
         let tx_types::SpendBody::V1(ref body) = spend.body else {
             unreachable!()
         };
diff --git a/release-version.json b/release-version.json
index 729bdae..612f465 100644
--- a/release-version.json
+++ b/release-version.json
@@ -1,4 +1,4 @@
 {
-  "version": "1.2.0",
+  "version": "1.3.0",
   "buildSequenceOffset": 1000
 }
diff --git a/scripts/update-signing-fixture.mjs b/scripts/update-signing-fixture.mjs
new file mode 100644
index 0000000..f4a0943
--- /dev/null
+++ b/scripts/update-signing-fixture.mjs
@@ -0,0 +1,38 @@
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { initSync, composeUnsignedTx, verifySignedDraft, inspectTxJam } from '../packages/wallet/src/pkg/nockster_core.js';
+
+const root = fileURLToPath(new URL('../', import.meta.url));
+const path = join(root, 'tests/fixtures/nockster-signed.json');
+const fixture = JSON.parse(readFileSync(path, 'utf8'));
+initSync({ module: readFileSync(join(root, 'packages/wallet/src/pkg/nockster_core_bg.wasm')) });
+const draft = composeUnsignedTx(fixture.source, [fixture.note], fixture.recipients, fixture.height);
+const temporary = mkdtempSync(join(tmpdir(), 'nockster-signing-fixture-'));
+try {
+  const input = join(temporary, 'draft.jam');
+  const output = join(temporary, 'signed.jam');
+  writeFileSync(input, Buffer.from(draft.base64Tx, 'base64'));
+  execFileSync('cargo', ['run', '-p', 'nockster-core', '--example', 'sign_test_fixture', '--', input, output, String(fixture.height)], {
+    cwd: join(root, 'nockster-esp'), stdio: 'inherit'
+  });
+  const signed = readFileSync(output).toString('base64');
+  verifySignedDraft(draft.base64Tx, signed);
+  const inspected = inspectTxJam(signed);
+  if (!inspected.spends.every(spend => spend.isFullySigned && spend.signedBy.includes(fixture.source)))
+    throw new Error('fixture must be fully signed by its public test key');
+  fixture.draft = draft.base64Tx;
+  fixture.fee = draft.feePaid;
+  fixture.signedTx = signed;
+  fixture.signer = {
+    implementation: 'nockster-core',
+    source: 'nockster-esp/crates/nockster-core/src/draft_sign/tx_v1.rs',
+    generator: 'scripts/update-signing-fixture.mjs'
+  };
+  writeFileSync(path, JSON.stringify(fixture, null, 2) + '\n');
+  console.log(`Updated verified signing fixture; fee ${fixture.fee} nicks at height ${fixture.height}.`);
+} finally {
+  rmSync(temporary, { recursive: true, force: true });
+}
diff --git a/tests/desktop-composer.test.ts b/tests/desktop-composer.test.ts
index 7687732..5ad54ca 100644
--- a/tests/desktop-composer.test.ts
+++ b/tests/desktop-composer.test.ts
@@ -13,6 +13,7 @@ import {
 import {
   initSync as initCore,
   inspectTxJam,
+  composeUnsignedTx,
   toRawTxJam,
   buildVault,
   importWallet,
@@ -51,6 +52,7 @@ const fixture = JSON.parse(
 );
 const recipient = fixture.recipients[0].address;
 const note: Note = {
+  note_data: fixture.note.noteData,
   name_first: fixture.note.firstName,
   name_last: fixture.note.lastName,
   origin_page: fixture.note.originPage,
@@ -315,3 +317,33 @@ test('largest-first selection splits outputs across notes without adding avoidab
     tx.free();
   }
 });
+
+test('wallet and hardware composers produce identical raw plans for the same snapshot', () => {
+  for (const height of [53999, 54000, 170000]) {
+    const notes = [
+      { ...fixture.note, assets: 10000000 },
+      { ...fixture.note, lastName: recipient, assets: 9000000 }
+    ];
+    const recipients = [{ address: recipient, gift: 11000000 }];
+    const wallet = composeUnsignedTx(fixture.source, notes, recipients, height);
+    const hardware = compose_tx_v1_min_inputs({
+      source_pkh: fixture.source,
+      notes: notes.map(value => ({
+        name_first: value.firstName,
+        name_last: value.lastName,
+        origin_page: value.originPage,
+        assets: value.assets,
+        version: 1,
+        note_data: value.noteData
+      })),
+      outputs: [{ recipient, amount: 11000000 }],
+      current_height: height
+    });
+    try {
+      assert.equal(wallet.feePaid, JSON.parse(hardware.summary_json).total_fees);
+      assert.equal(toRawTxJam(wallet.base64Tx), Buffer.from(hardware.raw_jam).toString('base64'));
+    } finally {
+      hardware.free();
+    }
+  }
+});
diff --git a/tests/fixtures/README.md b/tests/fixtures/README.md
new file mode 100644
index 0000000..019829b
--- /dev/null
+++ b/tests/fixtures/README.md
@@ -0,0 +1,19 @@
+# Signing fixture
+
+`nockster-signed.json` contains a public mnemonic-derived wallet, its RPC note,
+recipients, candidate height, unsigned wallet envelope, and a verified signed
+envelope. Its fee comes from the shared planner at that candidate height.
+
+Rebuild the wallet WASM, then regenerate it through the firmware signing entry
+point:
+
+```sh
+bash scripts/build-wasm.sh
+node scripts/update-signing-fixture.mjs
+npm test
+```
+
+The generator verifies the complete signature before writing the fixture.
+Independent Hoon byte/hash/proof/fee oracles live in the sibling `tx-types`
+repository at `tx-types/tests/reference`. The desktop composer test compares
+wallet and hardware raw JAM bytes at both sides of Bythos and at height 170000.
diff --git a/tests/fixtures/nockster-signed.json b/tests/fixtures/nockster-signed.json
index 01cb85e..0bde593 100644
--- a/tests/fixtures/nockster-signed.json
+++ b/tests/fixtures/nockster-signed.json
@@ -1,6 +1,6 @@
 {
-  "draft": "AfBW6C2qhihLBqlGCo0uaEjvikjozGhMTgsqqkimbG4mSEqvyIiqJicGa6ooKA8u7Gbure4IrYmqXAXom/Upb7KuY+sAAgeaNFoMrWeIAXYzYGdjWaogG2D/xSSXfpKkzoBfeZ77Fx0UrlmA3iCR9rRmnNYMIBAA0izh5PY3GuAfyDKuDWQcIAYQyMNCkVatzigH/MMjXAk5zA1L46qAB7eGjguQ908ODcAlaHuAvtbGBBXrmQEO8Dv5V9Y6ZNC1AwhIp915QwNpVAL+rZHr3yIOpGFqXAABCmr2OjrJO/kAAo0DSiNOeZmFAQQQMbEHAcCS7gMIJE1T1XW05bcCBNIjuMYd4VI5zeE8XVmA3jZ4xmh7x1cOIIA2HeCMPl7QGODvG1ZjWztERAYQ4Gv3/lbiFUgECAgtExaybx+uV8BnextbZw0Xz7gAAsECGPtWuFOsAQRK6JVKIdYb3QP8J8MerDaXn/gA/3xhkY8qyuIRIDDaaEmRMnElOpynHc7TAQkAQAMIdFQBRCtgXB0HEIgCkjvvdCdhDCBwzW67QD9CCh9AIE92Cr70Jg0b0K+q1T79mdPFlQ3n6mpI/Mzh2jmcpwMeAAR0yBAeztMCCQA+h/M0",
-  "fee": 651264,
+  "draft": "AfBWpo5MTI1mCGqOSOqsTcityS1KK8yo7eyoKG5MCk8NSU0MrWluJkyqhs6IxowKRwmpxoqsTkapXAXom/Upb7KuY+sAAgeaNFoMrWeIAXYzYGdjWaogG2D/xSSXfpKkzoBfeZ77Fx0UrlmA3iCR9rRmnNYMIBAA0izh5PY3GuAfyDKuDWQcIAYQyMNCkVatzigH/MMjXAk5zA1L46qAB7eGjguQ908ODcAlaHuAvtbGBBXrmQEO8Dv5V9Y6ZNC1AwhIp915QwNpVAL+rZHr3yIOpGFqXAABCmr2OjrJO/kAAo0DSiNOeZmFAQQQMbEHAcCS7gMIJE1T1XW05bcCBNIjuMYd4VI5zeE8Xdlwrq6Az/Y2ts7h2jmcpwMaAGAcQKCjCiBaAePqOIBAFJDceac7CWMAgWt22wX6EVL4AAJ5slPwpTdp2IB+Va326c+cLq4sQG8bPGO0veMrBxBAmw5wRh8vaAzw9w2rsa0dIiIDCPC1e38r8QokAgSElgkL2bcP16shAzFruHjGBRAIFsDYt8KdYg0gUEKvVAqx3uge4D8Z9mC1ufzEB/jnC4t8VFEWjwCB0UZLipSJK9HhPO1wng5IAAA6JD8O52mBBgCIDudp",
+  "fee": 2654208,
   "height": 50000,
   "note": {
     "assets": 6553600,
@@ -32,10 +32,11 @@
     }
   ],
   "source": "4Lu3cSW34WPwvDkTwKh7xB6yMZrvh3bFW7w26UDJVdboxADGkr2bTnL",
-  "signedTx": "AfDWZqmtRgonrm4qLAjNxgpnDo5JL00JygbOTiZNbQkNp2gJCgsJT00Oh+pIDElPzi5tSqhp5soqXAXom/Upb7KuY+sAAgeaNFoMrWeIAXYzYGdjWaogG2D/xSSXfpKkzoBfeZ77Fx0UrlmA3iCR9rRmnNYMIBAA0izh5PY3GuAfyDKuDWQcIAYQyMNCkVatzigH/MMjXAk5zA1L46qAB7eGjguQ908ODcAlaHuAvtbGBBXrmQEO8Dv5V9Y6ZNC1AwhIp915QwNpVAL+rZHr3yIOpGFqXAABCmr2OjrJO/kAAo0DSiNOeZmFAQQQMbEHAcCS7gMIJE1T1XW05bcCBNIjuMYd4VI5rYbbaAUQSFkdIwxRAJAP0PeJA5XuVU/QAQQq6S9TtBft9QP8TiPoee1o5MoAAhl5r+FsGJOIAAHXLySGfJ/H6gIIVCe/oqT0U5oHEPiL+LKY8Y6IDPDPLRiAn5ThmAP87bWR/3Nxt8IAe2CdS8QYuR0ECMz/9ki/dxXFcwEfSgi5HSDQF1RsDKiEazcGCERpMrUDvlXKkDZAsKP6FBwgsHyn7QZ+pqhhPOCHi+nqAwQ/x3DdAYJE3iD9gA6LQ/4GfMz4/mrAJxyKCQYIYgVk24GPWAkdHs7Tw3m6sgC9bfCM0faOrxxAAG06wBl9vKAxwN83rMa2doiIDCDA1+79rcQrkAgQEFomLGTfPlyvgM/2NrbOGi6ecQEEggUw9q1wp1gDCJTQK5VCrDe6B/hPhj1YbS4/8QH++cIiH1WUxSNAYLTRkiJl4kp0OE87nKcDEgCABhDoqAKIVsC4Og4gEAUkd97pTsIYQOCa3XaBfoQUPoBAnuwUfOlNGjagX1Wrffozp4srG87V1bCxMIdr53CeDngAENBhteVwnhZIAPA5nKcB",
+  "signedTx": "AfCWpghr5soKL4/OyA1OzQaH6k1rjkisLO6uxq1KTQstbG6uRikHJ+2q6qqmbgbtxuisDk2GJm4NXgXom/Upb7KuY+sAAgeaNFoMrWeIAXYzYGdjWaogG2D/xSSXfpKkzoBfeZ77Fx0UrlmA3iCR9rRmnNYMIBAA0izh5PY3GuAfyDKuDWQcIAYQyMNCkVatzigH/MMjXAk5zA1L46qAB7eGjguQ908ODcAlaHuAvtbGBBXrmQEO8Dv5V9Y6ZNC1AwhIp915QwNpVAL+rZHr3yIOpGFqXAABCmr2OjrJO/kAAo0DSiNOeZmFAQQQMbEHAcCS7gMIJE1T1XW05bcCBNIjuMYd4VI5rYbbaAUQSFkdIwxRAJAP0PeJA5XuVU/QAQQq6S9TtBft9QP8TiPoee1o5MoAAhl5r+FsGJOIAAHXLySGfJ/H6gIIVCe/oqT0U5oHEPiL+LKY8Y6IDPDPLRiAn5ThmAP87bWR/3Nxt8IAe2CdS8QYuR0ECMz/9ki/dxXFcwEfZS3aGSDAB9edDdg4ppA74K97sxUDvmkLxjZAMONrLRjQw8wud+DLUf2zAwQ0cbGjAYIrZgzqAEEbsQptgKC/Py464LewXucDPqbvRD5AUFgWHwl8zaxg+nCeHs7TlQ3n6gr4bG9j6xyuncN5OqABAMYBBDqqAKIVMK6OAwhEAcmdd7qTMAYQuGa3XaAfIYUPIJAnOwVfepOGDehX1Wqf/szp4soC9LbBM0bbO75yAAG06QBn9PGCxgB/37Aa29ohIjKAAF+797cSr0AiQEBombCQfftwvRqy57OGi2dcAIFgAYx9K9wp1gACJfRKpRDrje4B/pNhD1aby098gH++sMhHFWXxCBAYbbSkSJm4Eh3O0w7n6YAEAKBD4v5wnhZoAIDocJ4G",
   "signer": {
     "implementation": "nockster-core",
-    "revision": "6512eb95345eed16e94ed0ae96373597d60479ab"
+    "source": "nockster-esp/crates/nockster-core/src/draft_sign/tx_v1.rs",
+    "generator": "scripts/update-signing-fixture.mjs"
   },
   "publicKey": {
     "x": [