Status: IN
Proof siblings are tagged "left" or "right" because SHA-256 concatenation is order-dependent — `H(A||B) != H(B||A)` — so swapping sibling position produces a different parent hash and verification fails.
Source: entries/2026/05/29/topic-merkle-proof-security-model.md