{{ title }}

One on-chain coin, four owners, a tree of escape hatches.

Alice, Bob, Carol, and Dave pool 1.00 BTC into a single on-chain output, UTXO_1. Bitcoin sees exactly one coin. Underneath it, everyone pre-signs a tree of transactions that nobody intends to publish: two branch outputs splitting the coin, four leaves — one per person — and, hanging off each leaf, that person's REDEEM_TX. The redeem is the escape hatch: publish your path through the tree, left to right, and it pays you out with nobody's permission. Every box in the diagram except UTXO_1 lives in wallets, not on the chain.

Two catches, both from the gist. Building this tree needs everyone — A+B+C+D+S — to pre-sign together, which is the interactivity a covenant opcode like OP_CTV would remove. But after day 0, nobody ever needs the other three again: to spend, you talk only to S. That single change is what separates Ark from the older payment-pool designs, where every spend meant herding the whole pool.

Two payments, nobody paid on-chain — and one brand-new coin.

Alice owes Dave 0.10; Bob owes Carol 0.05. Neither payment touches UTXO_1. Instead, S batches both into a new coin it funds from its own pocket: UTXO_2, 0.65 BTC, with fresh leaves for Alice's change (0.30), Bob's change (0.20), Carol (0.05), and Dave (0.10) — each with its own dashed REDEEM_TX, exactly like day 0. In exchange, Alice and Bob each sign a FORFEIT_TX: “S may take my old redeem output — but only in a world where UTXO_2 actually exists.” The moment UTXO_2 confirms, the swap is atomic: the old claims belong to S, the new claims to their owners. Until it confirms, nothing has moved — treat the payment as instant only if you trust S not to rework pending transactions.

Carol and Dave now hold claims under two different roots at once — their untouched day-0 leaves in UTXO_1, plus their new leaves in UTXO_2, each root with its own clock. And note who had to be online: everyone with a leaf in UTXO_2 pre-signs its tree before it goes on-chain. That is the recipient interactivity the gist flags, and the thing later designs (and CTV) work to remove.

The same swap, four endings.

Everything above is machinery for exactly one guarantee: whatever anyone does after the swap is agreed, they cannot come out ahead by misbehaving. Run Alice-pays-Dave through all four worlds:

Carol walks out alone — and the tree unfolds behind her.

Carol never spent her day-0 leaf, and she has decided not to ask S for anything. So she publishes her path down the tree, transaction by transaction, paying a fee for each hop:

The server's books: front now, recover later.

S is not a custodian on the normal path — every user keeps a unilateral exit before expiry. But S does run a balance sheet: it funds new coins now, receives forfeits, and sweeps expired or forfeited branches later. The problem is not custody; it is timing — new money goes out today, old money comes back at maturity, and that gap is the liquidity requirement. The whole month, from S's side of the desk: