Thanks for the feedback! I will look into BNTs.

> each file is hashed with a random nonce, so as to distinguish files with identical contents

Actually, the purpose of the nonce is for privacy. The inclusion proof necessarily contains a leaf node hash, but I didn't want the proof to expose the hash of files it wasn't proving. That's because it could be private information, such as "bob has sensitive file X downloaded".

Since this approach makes determinism impossible, I chose to ignore the goroutine determinism part you mention.

Storing the tree nodes would likely still be required however, since otherwise the system would be brittle against things like file content and name changes, deletion, etc.