rhdl_dsig_scalable_core/

cert_unit.rs

//! The engine's only shared logic: the Merkle top and the Ed25519 certificate.
//!
//! # The problem
//!
//! Every batch of 128 one-time keys needs one *certificate*: an Ed25519
//! signature over the batch's Merkle root, so that a verifier who trusts the
//! signer's Ed25519 public key can trust all 128 keys. The keys of a batch are
//! spread over all the slices, and each slice can only hash its own
//! [subtree](crate::slice_merkle). Somebody has to join the subtree roots into
//! the batch root and get it signed. That is this unit, and it is the only
//! piece of logic all slices share.
//!
//! ```text
//!   slice 0 ─ subtree root r0 ─┐                                  ┌─▶ slice 0: certificate
//!   slice 1 ─ subtree root r1 ─┤   Merkle top   ──▶  Ed25519  ──▶ ├─▶ slice 1: certificate
//!     …                        ├─▶ (this unit)       (this unit)  │     …
//!   slice 7 ─ subtree root r7 ─┘                                  └─▶ slice 7: certificate
//! ```
//!
//! # Joining the subtrees
//!
//! Each [slice](crate::slice) builds one subtree of every batch (see
//! [`KEYS_PER_SLICE`](crate::KEYS_PER_SLICE)). This unit joins the
//! [`SLICES`](crate::SLICES) subtree roots into the batch root, using the
//! classic array ("heap") layout of a binary tree:
//!
//! ```text
//!   tree[1]                     root               (index 1 is the root)
//!   tree[2], tree[3]          ┌──┴──┐               parent i = H(tree[2i] ‖ tree[2i+1])
//!   …                                              children of i are 2i and 2i + 1
//!   tree[SLICES + s]        slice roots r0 … r(SLICES−1)
//! ```
//!
//! For the 8-slice build that is 4 + 2 + 1 compressions (levels 5, 6, 7); for
//! 2 slices it is a single one. They run one tree level at a time.
//!
//! ```text
//!   8-slice heap, by index
//!                          [1] batch root
//!               [2]                          [3]
//!        [4]           [5]            [6]           [7]
//!     [8]   [9]    [10]  [11]     [12]  [13]    [14]  [15]
//!      r0    r1     r2    r3       r4    r5      r6    r7
//! ```
//!
//! The heap layout makes "my sibling" and "my parent" plain bit operations
//! (`i ^ 1`, `i >> 1`), which is what hardware wants.
//!
//! # Signing and handing out
//!
//! ```text
//!   envelope  DSIGFP01 ‖ 1 ‖ 128 ‖ epoch ‖ batch ‖ root  ──▶ Ed25519 ──▶ signature
//! ```
//!
//! Every slice then receives the same commitment and signature, plus the
//! [`TOP_LEVELS`](crate::TOP_LEVELS) siblings above *its* subtree: at level
//! `t`, `tree[((SLICES + s) >> t) ^ 1]` (the other child of its ancestor).
//! With the siblings inside its own subtree, a signature carries the full
//! 7-sibling inclusion proof.
//!
//! # Why it is pipelined
//!
//! The Ed25519 core is barrel-threaded: one signature takes about 25,000
//! cycles from request to result, but with ~32 requests in flight it
//! completes one every ~895 cycles (the vendored `Ed25519SignCoreSmall`; the
//! earlier 1,1,1,0 profile managed ~758). One certificate covers a batch of
//! 128 keys, so 30M signatures/s at 205 MHz needs one every
//! 128 × 205 M / 30 M ≈ 875 cycles: right at the core's rate, which is why
//! this unit must keep many batches in the core at once:
//!
//! ```text
//!  roots ─▶ Merkle front ──request(tag = batch)──▶ Ed25519 core (≤ 32 in flight)
//!            │  ~100 cycles/batch                      │ results, any order
//!            ▼                                         ▼
//!     records[batch mod 32]                  signatures[tag mod 32], done bit
//!     (8 roots, 6 inner nodes, envelope)               │
//!            └──────────────┬──────────────────────────┘
//!                           ▼
//!          distribution, strictly in batch order ──▶ eight slices
//! ```
//!
//! (*Barrel-threaded* means the core interleaves many independent signatures
//! through one datapath, so it is slow per request but fast in total. The
//! planner, [`crate::config`], uses the same measured ~895 cycles per
//! signature with ≥ 32 in flight.)
//!
//! The front never waits for a signature, only for a free ring entry. A
//! completion is accepted only if its tag names a requested, not yet completed
//! batch; anything else is a sticky fault (the core's contract: reject unknown
//! or reused tags). [`IN_FLIGHT`] = 32 matches both the core's credits and the
//! slices' 32-batch key caches. `busy_cycles` counts cycles with any batch
//! inside the unit.
//!
//! # Tags and in-order delivery
//!
//! Each request carries its relative batch number as a *tag*, and the core
//! returns the tag with the signature. Results may come back out of order, so
//! the unit files each signature by `tag mod 32` and sets a done bit. The
//! slices, however, spend keys strictly in order, so certificates must leave
//! in order. Distribution therefore waits for the done bit of the oldest
//! undistributed batch, `dist`, even if younger batches are already done.
//!
//! ```text
//!   ring entry:   0    1    2    3    4   …        dist = 1, front = 5
//!   batch:        -    b1   b2   b3   b4           (b0 already distributed)
//!   done bit:     -    0    1    1    0            b2, b3 signed early: they wait
//!                      ▲ distribution waits here until b1's signature returns
//!   accepted tag = a batch in [dist, front) whose done bit is still 0
//! ```
//!
//! Each slice offers at most two subtree roots ahead (the root queue of each slice holds two);
//! roots arrive in batch order because each slice finishes its keys in order.

use crate::TOP_LEVELS;
use crate::blake3_core::{CompressionInput, InlineCompressionPipeline, SINGLE_BLOCK_ROOT};
use crate::certificate::batch_commitment_words;
use crate::ed25519::{CertificateSigner, CertificateSignerInput, ScalarWords};
use crate::slice_factory::{IV_BITS, bytes_from_words_kernel, words_from_bytes_kernel};
use crate::slice_merkle::SubtreeRoot;
use crate::slice_signer::Certificate;
use rhdl::prelude::*;
use rhdl_fpga::core::{
    dff::DFF,
    ram::synchronous::{In as RamIn, SyncBRAM, Write as RamWrite},
};

/// Slices joined by this unit (the crate-wide area knob).
pub use crate::SLICES;
/// Heap slots of the Merkle top: index 0 unused, `1..SLICES` inner nodes,
/// `SLICES..2·SLICES` slice roots.
pub const TREE_NODES: usize = 2 * SLICES;
/// Heap index of the first node of the bottom inner level.
///
/// That level has `SLICES / 2` nodes, at heap indices `SLICES/2 .. SLICES`.
const BOTTOM_LEVEL: b4 = b4((SLICES / 2) as u128);

/// Flags for a 64-byte single-block root hash.
pub const FLAGS_SINGLE_BLOCK: b32 = b32(SINGLE_BLOCK_ROOT as u128);

/// Configuration, stable while running.
#[derive(Clone, Copy, Debug, PartialEq, Digital)]
pub struct CertConfig {
    /// Durably allocated epoch.
    pub epoch: b64,
    /// Batch id of relative batch 0.
    pub first_batch: b64,
    /// Secret Ed25519 seed.
    pub key_seed: ScalarWords,
    /// Load the key and certify batches.
    pub run: bool,
}

/// Inputs from the slices.
#[derive(Clone, Copy, Debug, PartialEq, Digital)]
pub struct CertInput {
    /// Configuration.
    pub config: CertConfig,
    /// Subtree-root pulses, one per slice.
    pub roots: [SubtreeRoot; SLICES],
    /// Each slice accepted the offered certificate this cycle.
    pub taken: [bool; SLICES],
}

/// Outputs to the slices.
#[derive(Clone, Copy, Debug, PartialEq, Digital)]
pub struct CertOutput {
    /// Certificate offered to each slice (held until taken).
    pub certificates: [Certificate; SLICES],
    /// Ed25519 public key once loaded.
    pub public_key: ScalarWords,
    /// The Ed25519 key is loaded.
    pub key_loaded: bool,
    /// Batches fully certified and distributed.
    pub certified: b32,
    /// Batches whose subtree roots have left the root queues (= batches
    /// sent to the Ed25519 core). Slices use it as root credit: a slice may
    /// work on batch `b` only while `b < roots_popped + ROOT_QUEUE`, so no
    /// root ever arrives at a full queue.
    pub roots_popped: b32,
    /// Cycles spent with a batch in progress (Merkle, signing, distribution).
    pub busy_cycles: b64,
    /// A root arrived for a full queue, or the signer reported an error.
    pub fault: bool,
}

/// Phase of the Merkle front (one batch at a time, about 100 cycles each).
#[derive(Clone, Copy, Debug, PartialEq, Digital, Default)]
pub enum Phase {
    /// Waiting for every slice's root of the next batch.
    #[default]
    Idle,
    /// Compressions of one tree level in flight (see `CertControl::level`).
    Hashing,
    /// Offering the signing request until the core accepts it.
    Sign,
}

/// Batches that may be between "signature requested" and "distributed".
///
/// Equal to the Ed25519 core's admission credits (32 for profile 1,1,1,0) and
/// to the slices' cache depth in batches, so neither side is the bottleneck.
pub const IN_FLIGHT: usize = 32;

/// Subtree roots each slice may have waiting in the cert unit's root queue.
///
/// The queue is two deep per slice. Before this credit existed, a slice
/// offered roots as fast as it made keys (up to 8 batches ahead), so while
/// the Ed25519 core was still loading its key a third root met a full queue,
/// was dropped and set the sticky fault. The first card run stopped at 6 of
/// 8 batches that way (2026-10-14). Slices now wait for credit
/// ([`CertOutput::roots_popped`]).
pub const ROOT_QUEUE: usize = 2;

/// Batches the front may have outstanding: [`IN_FLIGHT`], or 1 with the
/// measurement-only `cert-serial` feature, which reproduces the earlier
/// one-batch-at-a-time unit so its cost can be measured (see the crate page,
/// "How it got fast").
pub const MAX_OUTSTANDING: usize = if cfg!(feature = "cert-serial") { 1 } else { IN_FLIGHT };

/// Everything about one batch except its signature, kept until distribution.
///
/// Written into the `records` RAM at `batch mod 32` when the signing request
/// is issued, read back when the batch is distributed.
#[derive(Clone, Copy, Debug, PartialEq, Digital)]
pub struct CertRecord {
    /// The batch's Merkle top in heap layout (slice roots included).
    pub tree: [[b8; 32]; TREE_NODES],
    /// Signed envelope bytes.
    pub commitment: [b8; 64],
}

/// Resettable control.
#[derive(Clone, Copy, Debug, PartialEq, Digital)]
pub struct CertControl {
    /// Merkle front phase.
    pub phase: Phase,
    /// Roots queued per slice (0..=2).
    pub queued: [b2; SLICES],
    /// Heap index of the first node of the level being hashed; that level
    /// has exactly this many nodes (`SLICES/2`, …, 2, 1).
    pub level: b4,
    /// Compressions issued in the current level.
    pub issued: b4,
    /// Results returned in the current level.
    pub returned: b4,
    /// The key-load request was accepted.
    pub key_requested: bool,
    /// Relative batch in the Merkle front (= batches requested so far).
    pub front: b32,
    /// Relative batch next to distribute (= batches certified so far).
    pub dist: b32,
    /// Signature received, per ring entry `batch mod IN_FLIGHT`.
    pub done: [bool; IN_FLIGHT],
    /// Distribution step: 0 wait for signature, 1 RAM read, 2 offering.
    pub stage: b2,
    /// Slices that took the current certificate.
    pub delivered: [bool; SLICES],
    /// Busy-cycle counter.
    pub busy: b64,
    /// Sticky fault.
    pub fault: bool,
}

/// Resetless datapath of the Merkle front.
#[derive(Clone, Copy, Debug, PartialEq, Digital)]
pub struct CertData {
    /// Two queued roots per slice, oldest in index 0.
    pub roots: [[[b8; 32]; 2]; SLICES],
    /// Merkle top of the batch in the front (heap layout).
    pub tree: [[b8; 32]; TREE_NODES],
    /// Batch root.
    pub root: [b8; 32],
    /// Signed envelope bytes.
    pub commitment: [b8; 64],
}

/// The shared certificate unit.
///
/// One BLAKE3 lane for the Merkle top, the Ed25519 signer, two 32-entry
/// rings (records and signatures) and the control/data registers.
#[derive(Clone, Debug, Synchronous, SynchronousDQ)]
pub struct CertUnit {
    /// Pipelined BLAKE3 compression for the Merkle top; results come back
    /// with the heap index as tag.
    lane: InlineCompressionPipeline,
    /// The Ed25519 certificate signer (vendored RHDL core, see
    /// [`crate::ed25519`]).
    signer: CertificateSigner,
    /// Per-batch Merkle top and envelope, indexed by `batch mod 32`.
    records: SyncBRAM<CertRecord, 5>,
    /// Per-batch Ed25519 signature, indexed by `tag mod 32`.
    signatures: SyncBRAM<[b8; 64], 5>,
    /// Phases, counters, done bits (reset to idle).
    control: DFF<CertControl>,
    /// Queued roots and the front's tree (no reset).
    data: DFF<CertData>,
}

impl Default for CertUnit {
    /// Idle front, nothing requested or distributed, key not loaded.
    fn default() -> Self {
        Self {
            lane: InlineCompressionPipeline,
            signer: CertificateSigner::default(),
            records: SyncBRAM::default(),
            signatures: SyncBRAM::default(),
            control: DFF::new(CertControl {
                phase: Phase::Idle,
                queued: [b2(0); SLICES],
                level: b4(0),
                issued: b4(0),
                returned: b4(0),
                key_requested: false,
                front: b32(0),
                dist: b32(0),
                done: [false; IN_FLIGHT],
                stage: b2(0),
                delivered: [false; SLICES],
                busy: b64(0),
                fault: false,
            }),
            data: DFF::resetless(),
        }
    }
}

/// Input: subtree roots, slice acknowledgements and configuration. Output:
/// one certificate offer per slice, plus status.
impl SynchronousIO for CertUnit {
    type I = CertInput;
    type O = CertOutput;
    type Kernel = cert_unit_kernel;
}

/// Little-endian bytes of eight 64-bit words.
///
/// Turns the Ed25519 core's word-oriented envelope and signature into the
/// 64 bytes that go into the frame. Combinational.
#[allow(clippy::needless_range_loop)]
#[kernel]
pub fn words64_to_bytes_kernel(words: [b64; 8]) -> [b8; 64] {
    let mut bytes = [b8(0); 64];
    for w in 0..8 {
        for b in 0..8 {
            bytes[8 * w + b] = (words[w] >> (8 * b as u128)).resize();
        }
    }
    bytes
}

/// A single-block BLAKE3 root hash of `left ‖ right`.
///
/// Builds the lane request for one Merkle-top node: IV key, 64-byte block,
/// counter 0, single-block root flags. `tag` (the heap index) comes back
/// with the result; `valid` says whether the request is real. Combinational.
#[allow(clippy::needless_range_loop)]
#[kernel]
pub fn pair_request_kernel(
    left: [b8; 32],
    right: [b8; 32],
    tag: b32,
    valid: bool,
) -> CompressionInput {
    let mut bytes = [b8(0); 64];
    for b in 0..32 {
        bytes[b] = left[b];
        bytes[32 + b] = right[b];
    }
    CompressionInput {
        cv: IV_BITS,
        block: words_from_bytes_kernel(bytes),
        counter_low: b32(0),
        counter_high: b32(0),
        block_len: b32(64),
        flags: FLAGS_SINGLE_BLOCK,
        tag,
        valid,
    }
}

/// The certificate unit's wiring.
///
/// Four independent machines share this kernel, connected only through
/// counters and the two RAMs:
///
/// 1. **root queues**: up to two roots per slice;
/// 2. **Merkle front** (`phase`): Idle → Hashing (one level at a time, one
///    compression per cycle) → Sign; one batch at a time;
/// 3. **Ed25519 issue and completion**: request with `tag = front`, file
///    results by tag, check every tag;
/// 4. **distribution** (`stage`): wait for the oldest batch's signature,
///    read both RAMs, offer to all slices until each has taken it.
///
/// Timing: the RAMs answer one cycle after their address; the lane and the
/// Ed25519 core return results many cycles later, tagged.
#[allow(clippy::too_many_lines, clippy::needless_range_loop)]
#[kernel]
pub fn cert_unit_kernel(
    clock_reset: ClockReset,
    input: CertInput,
    q: CertUnitQ,
) -> (CertOutput, CertUnitD) {
    let resetting = clock_reset.reset.any();
    // Next-state copies of the registers.
    let mut c = q.control;
    let mut data = q.data;
    let cfg = input.config;

    // ---------------------------------------------------- root queues
    // Append each arriving root to its slice's 2-entry queue; a third root
    // would overwrite one still needed, so it is a fault instead.
    let mut queued = q.control.queued;
    for s in 0..SLICES {
        if input.roots[s].valid {
            if queued[s] == b2(0) {
                data.roots[s][0] = input.roots[s].root;
                queued[s] = b2(1);
            } else if queued[s] == b2(1) {
                data.roots[s][1] = input.roots[s].root;
                queued[s] = b2(2);
            } else {
                c.fault = true;
            }
        }
    }
    // Every slice has delivered its root of the next batch.
    let mut all_ready = true;
    for s in 0..SLICES {
        if q.control.queued[s] == b2(0) {
            all_ready = false;
        }
    }

    // ---------------------------------------------------- Merkle top
    // The lane's current result: tag = heap index, first 32 bytes = node.
    let result = q.lane;
    let r_index: b4 = result.tag.resize();
    let r_bytes = bytes_from_words_kernel(result.words);
    let mut r_node = [b8(0); 32];
    for b in 0..32 {
        r_node[b] = r_bytes[b];
    }
    let phase = q.control.phase;
    // Batches requested from Ed25519 but not yet distributed.
    let outstanding = q.control.front - q.control.dist;
    if phase != Phase::Idle || outstanding != b32(0) {
        c.busy = q.control.busy + b64(1);
    }
    // Node `n = level + issued` of the current level reads its two children.
    let n = q.control.level + q.control.issued;
    // Children 2n and 2n + 1 (constant-index loop for RHDL).
    let mut left = q.data.tree[0];
    let mut right = q.data.tree[0];
    for k in 1..SLICES {
        if n == b4(k as u128) {
            left = q.data.tree[2 * k];
            right = q.data.tree[2 * k + 1];
        }
    }
    // The lane request for node n; only sent if `valid` is set below.
    let mut lane = pair_request_kernel(left, right, n.resize(), false);
    // Set when this batch's roots are no longer needed (request issued).
    let mut pop_roots = false;
    if phase == Phase::Idle {
        if all_ready && cfg.run {
            // Copy the oldest root of every slice into the heap's leaves.
            for s in 0..SLICES {
                data.tree[SLICES + s] = q.data.roots[s][0];
            }
            c.phase = Phase::Hashing;
            c.level = BOTTOM_LEVEL;
            c.issued = b4(0);
            c.returned = b4(0);
        }
    } else if phase == Phase::Hashing {
        // Issue one compression per cycle until the whole level is issued.
        if q.control.issued < q.control.level {
            lane.valid = true;
            c.issued = q.control.issued + b4(1);
        }
        // Store each result at its heap index.
        if result.valid {
            for k in 1..SLICES {
                if r_index == b4(k as u128) {
                    data.tree[k] = r_node;
                }
            }
            c.returned = q.control.returned + b4(1);
            // Level complete: either it was the root, or move one level up.
            if q.control.returned + b4(1) == q.control.level {
                if q.control.level == b4(1) {
                    // tree[1] is the batch root.
                    data.root = r_node;
                    let batch_id = cfg.first_batch + q.control.front.resize::<64>();
                    data.commitment = words64_to_bytes_kernel(batch_commitment_words(
                        cfg.epoch, batch_id, r_node,
                    ));
                    c.phase = Phase::Sign;
                } else {
                    c.level = q.control.level >> 1;
                    c.issued = b4(0);
                    c.returned = b4(0);
                }
            }
        }
    }

    // ---------------------------------------------------- Ed25519 issue
    // The core keeps ~32 requests in flight and may finish them out of
    // order, so the front never waits for a signature: it only needs a free
    // ring entry (fewer than IN_FLIGHT batches undistributed).
    let signed = q.signer;
    // Load the secret key once, the first time the core is ready for it.
    let load_key = cfg.run && !q.control.key_requested && signed.load_key_ready;
    if load_key {
        c.key_requested = true;
    }
    // A ring entry is free for one more batch.
    let ring_free = outstanding < b32(MAX_OUTSTANDING as u128);
    // Offer the signing request; `issued` is the handshake completing.
    let requesting = phase == Phase::Sign && signed.key_loaded && ring_free && !resetting;
    let issued = requesting && signed.ready;
    // Ring entry of the batch in the front: `front mod 32`.
    let front_entry: b5 = q.control.front.resize();
    let record = CertRecord {
        tree: q.data.tree,
        commitment: q.data.commitment,
    };
    if issued {
        // The record is written at `front_entry` (below); the front is free
        // for the next batch.
        c.phase = Phase::Idle;
        c.front = q.control.front + b32(1);
        pop_roots = true;
    }
    if signed.internal_error {
        c.fault = true;
    }

    // ---------------------------------------------------- Ed25519 completion
    // Accept a tag only if it names a requested, not yet completed batch.
    // Ring entry the returned signature belongs to.
    let done_entry: b5 = signed.tag.resize();
    // Distance from the oldest undistributed batch (wraps, so "too old" and
    // "never requested" both come out ≥ outstanding).
    let age: b16 = signed.tag - q.control.dist.resize::<16>();
    // The entry's done bit is already set: a duplicate result.
    let mut already = false;
    for e in 0..IN_FLIGHT {
        if done_entry == b5(e as u128) && q.control.done[e] {
            already = true;
        }
    }
    let completion_ok = age < outstanding.resize::<16>() && !already;
    let completing = signed.valid && completion_ok && !resetting;
    if signed.valid && !completion_ok {
        c.fault = true;
    }
    if completing {
        for e in 0..IN_FLIGHT {
            if done_entry == b5(e as u128) {
                c.done[e] = true;
            }
        }
    }

    // ---------------------------------------------------- distribution
    // Strictly in batch order. Both RAMs are always read at `dist mod 32`;
    // their registered outputs stay stable while that entry is offered.
    let dist_entry: b5 = q.control.dist.resize();
    // The oldest undistributed batch has its signature.
    let mut head_done = false;
    for e in 0..IN_FLIGHT {
        if dist_entry == b5(e as u128) && q.control.done[e] {
            head_done = true;
        }
    }
    let stage = q.control.stage;
    if stage == b2(0) && head_done {
        c.stage = b2(1);
    } else if stage == b2(1) {
        // RAM outputs are valid from the next cycle; nobody has it yet.
        c.stage = b2(2);
        c.delivered = [false; SLICES];
    }
    let offering = stage == b2(2);
    // The record of batch `dist` (tree + envelope) from the records RAM.
    let head = q.records;
    // The same certificate for every slice; only `valid` and `top` differ.
    let mut certificates = [Certificate {
        valid: false,
        batch: q.control.dist,
        commitment: head.commitment,
        signature: q.signatures,
        top: [[b8(0); 32]; TOP_LEVELS],
    }; SLICES];
    for s in 0..SLICES {
        certificates[s].valid = offering && !q.control.delivered[s] && !resetting;
        // Sibling at top level t: the other child of slice s's ancestor.
        for t in 0..TOP_LEVELS {
            certificates[s].top[t] = head.tree[((SLICES + s) >> t) ^ 1];
        }
    }
    if offering {
        // Track who has taken it; finish when every slice has.
        let mut all = true;
        for s in 0..SLICES {
            let got = q.control.delivered[s] || input.taken[s];
            c.delivered[s] = got;
            if !got {
                all = false;
            }
        }
        if all {
            // Batch distributed: free its ring entry for a new batch.
            c.stage = b2(0);
            c.dist = q.control.dist + b32(1);
            for e in 0..IN_FLIGHT {
                if dist_entry == b5(e as u128) {
                    c.done[e] = false;
                }
            }
        }
    }
    // Drop each slice's oldest root (the one just requested).
    if pop_roots {
        for s in 0..SLICES {
            data.roots[s][0] = data.roots[s][1];
            queued[s] = queued[s] - b2(1);
        }
    }
    c.queued = queued;

    // Absolute batch id of the batch in the front.
    let batch_id = cfg.first_batch + q.control.front.resize::<64>();
    let d = CertUnitD {
        lane,
        // Signing request for the front batch, tagged with its relative
        // batch number.
        signer: CertificateSignerInput {
            load_key_valid: load_key,
            key_seed: cfg.key_seed,
            clear_key: false,
            valid: requesting,
            epoch: cfg.epoch,
            batch_id,
            root: q.data.root,
            tag: q.control.front.resize(),
        },
        // Write the front's record on issue; read the distribution head.
        records: RamIn::<CertRecord, 5> {
            read_addr: dist_entry,
            write: RamWrite::<CertRecord, 5> {
                addr: front_entry,
                value: record,
                enable: issued,
            },
        },
        // File each accepted signature by its tag; read the distribution head.
        signatures: RamIn::<[b8; 64], 5> {
            read_addr: dist_entry,
            write: RamWrite::<[b8; 64], 5> {
                addr: done_entry,
                value: words64_to_bytes_kernel(signed.signature.words),
                enable: completing,
            },
        },
        control: c,
        data,
    };
    (
        CertOutput {
            certificates,
            public_key: signed.public_key,
            key_loaded: signed.key_loaded,
            certified: q.control.dist,
            roots_popped: q.control.front,
            busy_cycles: q.control.busy,
            fault: q.control.fault,
        },
        d,
    )
}