Topological change in a bounded ledger.
Bitcoin is the first observable thermodynamic system whose volume is not spatial but algebraic. The paper that frames this object[1] identifies the key space as the thermodynamic container within which all value-bearing states must exist. The admissible private-key domain is exactly kpriv = {1, 2, …, n − 1}, with cardinality Npriv = n − 1 ≈ 1.1579 × 1077.[6] This cardinality is fixed by the subgroup order of secp256k1 and persists unchanged across the entire timechain. It cannot be enlarged without replacing the curve itself, which would constitute a different identity manifold and therefore a different ledger universe.
In this framework, a UTXO is not merely a balance. It is a localized container anchored to a discrete identity coordinate inside a finite manifold. Every satoshi exists inside a UTXO, and every UTXO exists only by occupying a specific quantized position in identity. The paper is explicit: “There is no representation in the protocol for partial keys, intermediate coordinates, or sub-identity units.”[2] The identity quantum is atomic. The mapping from private-key quanta to public observable loci is bijective. One private key, one public identity, one UTXO anchor.
That was the geometry of pre-Taproot Bitcoin. It is no longer the complete geometry.
The paper establishes seven rules that any bounded ledger must satisfy.[5] They are not conventions or preferences. They are structural requirements: remove any one and the ledger ceases to function as a coherent thermodynamic object. Three of the seven are untouched by Taproot. Four are not.
Rule 1 — Cardinality. The identity domain is finite and non-expanding. The total supply is fixed at 2.1 × 108 BTC. The keyspace has cardinality ~1.1579 × 1077. No valid state transition may increase either.[5]
Rule 2 — Resolution. The satoshi is the minimum unit. All ledger states are integer-valued over this unit. No fractional satoshis may exist.[4]
Rule 3 — Discrete Existence. “To exist in Bitcoin is to occupy a specific coordinate in bounded memory with a nonzero quantum of committed value at a discrete block height.”[4] Existence is binary. A UTXO exists if and only if it contains at least one satoshi. There is no partial existence.
Rule 4 — Time. Time is the count of irreversible memory commitments. It advances only when blocks are committed. Between blocks, the ledger does not evolve.[9]
Rule 5 — Non-Contradiction. “Each resolved quantum may be consumed at most once.”[5] The prohibition on double spends is the precise meaning of non-contradiction within a bounded ledger.
Rule 6 — Historical Permanence. “Every successful proof-of-work, every confirmed transaction, every spent output becomes a permanent part of the ledger’s crystallized structure. Nothing resolved is ever reclaimed by entropy.”[7]
Rule 7 — Finite State-Space. The state-space is finite. The evolution is ordinally unbounded. The system traverses its domain without exceeding it.[8]
Rules 1, 2, and 4 are preserved under Taproot. The total supply is unchanged. The satoshi remains indivisible. Blocks still produce time. The four rules that face strain are Rules 3, 5, 6, and 7. Each is strained in a different way. The next three sections examine each in turn.
One qualification is essential. Taproot is a soft fork. It did not replace the address types that came before it. Legacy P2PKH, P2SH, and SegWit v0 (P2WPKH, P2WSH) outputs continue to be created, spent, and validated under the original rules. The strains described in the following sections apply only to Taproot outputs — those using SegWit version 1 with the 32-byte witness program. The ledger is not uniformly post-Taproot. It is a mixed system in which some UTXOs still satisfy all seven rules with mechanical neatness while others carry the new topological complexities. The observability gap is partial, not universal. But the two populations are not isolated. A single transaction can spend both a legacy P2PKH input and a Taproot input, entangling their histories in one state transition. The chain is not merely stratified; it is interleaved.
Under Taproot, an output key Q is computed as Q = P + int(t)G, where P is an internal public key, t is the TapTweak hash of P and the Merkle root of a script tree, and G is the curve generator. Every Taproot output corresponds to a combination of a single public-key condition (the internal key P) and zero or more general conditions encoded in scripts organized in a tree.[3] Satisfying any of these conditions is sufficient to spend the output.
In the paper’s language, a single UTXO, supposedly anchored to exactly one identity quantum (the output key Q), is in fact algebraically bound to a set of admissible future states. The on-chain identity Q is not merely a point in keyspace. It is a commitment to a hidden manifold of scripts. The internal key P is one possible spending path. The Merkle tree of scripts contains the others. The output key Q is the common projection of all of them.
The paper writes: “A UTXO is still anchored to exactly one of these identity quanta.”[2] Taproot preserves this at the level of the output script: the witness program is exactly 32 bytes, a single public key. But that public key is not a simple identity coordinate. It is a tweaked commitment that encodes, in its algebraic construction, the root of an entire tree of alternative conditions. The UTXO is anchored to one observable point. That point is the compressed image of a higher-dimensional object.
The work to build the Merkle tree is performed off-chain. Energy is expended: scripts are written, hashed, paired, and rooted. This computation is real, thermodynamically costly, and materially necessary for the output to function as designed. But once the output is created, the tree is not visible on the ledger. Only the root’s imprint, through the tweak t, is present in Q.
If the output is later spent via the key path — a BIP 340 signature against Q — the script tree is never revealed. The work that built it is erased from the perspective of the chain, even though it happened.
Rule 3 states that existence is discrete and binary: a UTXO exists if and only if it occupies a specific coordinate with nonzero committed value.[4] The script tree exists as a mathematical object, has consumed energy in its preparation, and determines which future states the UTXO can enter. But the ledger does not register its existence. The tree is neither instantiated nor uninstantiated in the paper’s sense. It occupies a new category: committed but unregistered.
Key-path vs. script-path — per BIP 341:[3]
Rule 6 states that every resolved state becomes a permanent part of the ledger’s crystallized structure.[7] The energy spent building the Merkle tree is a resolved state — computation was performed, hashes were computed, the tree was rooted. But if the key path is taken, this resolution is not recorded on-chain. The thermodynamic preparation is real. The historical record is silent.
Consider a Taproot output with a MAST tree containing N possible spending conditions. At creation, the Merkle tree encodes log2(N) bits of script-choice entropy. The energy to build the tree has been spent. The hashes have been computed. The entropy field is real. But if the output is spent via the key path, all N − 1 unexecuted script paths are cryptographically erased from the ledger. No witness reveals them. No node can reconstruct them without the original tree data. The information is not destroyed in the physical sense — the hashes still exist as mathematical objects — but it is removed from the consensus-accessible record. The chain cannot audit what was committed but not spent.
This is a new kind of irreversibility. The paper’s framework recognizes one fundamental irreversible act: the conversion of a finite entropy field into a single committed block.[7] Taproot introduces a second irreversible act at a smaller scale: the silent annihilation of prepared possibility. The unchosen script paths are not explicitly invalidated; they simply vanish from the observable state when the key path is taken. The ledger records that the output was spent. It does not record what else could have spent it.
Landauer’s principle states that erasing information has a thermodynamic cost. In this case, the erasure is performed by the network’s own consensus rules: the key-path spend is valid, therefore the script paths are never checked, therefore their existence is never registered. The cost of this erasure is not paid by the spender. It is paid by every future auditor who attempts to verify the completeness of the ledger’s state space and finds that the space of committed possibilities exceeds the space of revealed ones.
Key-path vs. script-path — per BIP 341:[3]
In both paths, the unchosen script paths vanish from the consensus-accessible record. The script path is marginally better for observability: at least one prepared condition is revealed, one branch of the Merkle tree is verified, and one admissible future is enumerated. But the improvement is partial. The bulk of the committed structure — the remaining N − 1 paths, the internal pairings, the root-to-leaf topology — remains latent regardless of which path is taken. The choice is not between transparency and opacity. It is between total opacity and selective opacity.
BIP 340 introduces Schnorr signatures and, with them, x-only public keys. Instead of the 33-byte compressed format that encodes both the x-coordinate and the parity of the y-coordinate, the x-only format stores only the x-coordinate: 32 bytes. The rationale is efficiency. The cost is orientation.
On the secp256k1 curve, for every x-coordinate there exist two valid points: (x, y) and (x, −y mod p). In the group of order n, if k is a valid private key, then n − k is also a valid private key, and their corresponding public keys are negatives of each other. They share the same x-coordinate. Under x-only encoding, the pair {k, n − k} collapses onto a single observable ledger coordinate.
The paper assumes a bijection between admissible private-key quanta and public identity loci. BIP 340 breaks that assumption. The mapping is now 2-to-1. Two distinct private-key quanta control the same public locus. The identity manifold itself — the finite field of ~1.1579 × 1077 admissible private keys — remains unchanged in cardinality. But its projection onto the observable ledger has acquired an intrinsic reflection symmetry: a folding that loses the sign of orientation while preserving location.
This is not a break of the Cardinal Rule. The keyspace is not enlarged. It is not subdivided. What changes is the resolution of observation. The ledger can distinguish where value is anchored, but not which of two mirrored keys holds authority. The thermometer still reads the temperature; it no longer records whether the reading is positive or negative. In most practical contexts this degeneracy is harmless: both keys control the same UTXO. But the degeneracy reveals that the identity quantum, which the paper treats as the irreducible atom of ledger authority, now carries an internal symmetry that the observable state cannot resolve.
Rule 5 requires that each resolved quantum may be consumed at most once.[5] The 2:1 reflection does not violate this rule — the UTXO is still spent exactly once — but it introduces an ambiguity about which authority consumed it. The ledger records the consumption. It does not record which of two mirrored keys authorized it. The non-contradiction is preserved at the level of the UTXO. It is degraded at the level of the key.
Key-path vs. script-path — per BIP 341:[3]
Consider a Taproot output Q = P + int(t)G, where P is an internal key and t is the TapTweak hash of P and a Merkle root of a script tree. The output is created. The Merkle tree is built off-chain: scripts are written, hashed, paired, rooted. Energy is spent. The tree encodes log2(N) bits of script-choice entropy for N possible spending conditions. The output key Q is published. The tree is not.
Two distinct classes of future states are now algebraically bound to Q. The first class is reachable through the key path: a BIP 340 signature against Q, using the tweaked private key corresponding to P. The second class is reachable through the script path: reveal one script from the Merkle tree, provide the Merkle proof, and satisfy the script’s conditions. Both classes are valid. Both are admissible. Only one is visible.
If the output is spent via the key path, the script tree is never revealed. The N − 1 unexecuted script paths are not checked, not registered, not recorded. The observer sees a single signature against Q. The observer cannot determine whether Q commits to zero scripts, one script, or a thousand. The boundary Q is identical in all three cases.
This is the observability gap: the mapping from the observable boundary (the output key Q) to the enclosed state space (all admissible future states) is many-to-one. The paper assumes this mapping is bijective.[2] Under Taproot, it is not. The observable boundary does not uniquely determine the set of possible futures.
Rule 7 requires a finite state-space with ordinally unbounded evolution.[8] The state-space is finite. But after Taproot, not all states in that space are enumerable from the chain alone. The state-space is finite but partially opaque. The paper assumes that every microstate is, in principle, observable from the ledger’s record. Under Taproot, some microstates are latent: real enough to have consumed energy in their preparation, yet inaccessible to the consensus mechanism.
The paper claims: “Any node can verify, from Genesis to the present, that no unit of value has appeared or vanished without passing through the rules.”[1] This remains true for validity. Every satoshi that moves does so under a valid signature or script. But it is no longer true for completeness of observability. A node verifying a key-path spend cannot audit what other conditions were committed to in the MAST tree. The full thermodynamic state of the output — all the work that went into preparing its alternative futures — is cryptographically bound but practically hidden.
No discrete logarithm is broken. No hash is collided. No signature is forged. The gap is not cryptographic in the conventional sense. It is topological: the algebraic structure of Taproot commitments creates a projection from a higher-dimensional commitment object onto a 0-dimensional observable point. The projection is information-preserving in the algebraic sense (the tree is bound to Q through the tweak). But it is information-destroying in the observational sense (the tree cannot be recovered from Q without the original data).
BIP 341 describes this structure explicitly and warns that naive key aggregation must not be used without proof-of-possession protocols.[4] The warning is technical and correct. What the warning does not address is the structural character of the gap itself: a designed-in opacity that affects every Taproot output, not merely adversarial constructions.
This creates what the paper would recognize as an epistemic horizon inside the ledger itself. Not the horizon between mempool and block, between possibility and commitment. But a horizon within the committed state, between what is revealed and what is concealed by the algebraic structure of the output itself.
Key-path vs. script-path — per BIP 341:[3]
After examining Rules 3, 5, 6, and 7 individually, a clear pattern emerges. Taproot does not undermine the ledger’s bedrock; it erodes its observability layer. Rules 1, 2, and 4 — Cardinality, Resolution, and Time — remain structurally untouched because they govern quantities that are independent of how data is revealed. The total supply is still fixed. The satoshi is still indivisible. Blocks still advance time. These are arithmetic facts, and Taproot is an algebraic upgrade. Arithmetic survives.
The four strained rules form a coherent group: they all concern what the ledger can see, record, and enumerate. Rule 3 (Discrete Existence) is strained because prepared script trees consume energy and determine future states without being registered. Rule 6 (Historical Permanence) is strained because that same preparation can be silently erased when the key path is taken. Rule 5 (Non-Contradiction) is strained because the x-only key format folds two private-key quanta onto one public locus, degrading the bijection between authority and observable identity. Rule 7 (Finite State-Space) is strained because the mapping from observable boundary to enclosed possibility is no longer one-to-one.
These four strains are not independent failures. They are different faces of the same topological change: the ledger’s observable surface has been compressed while its algebraic interior has grown more complex. The container is still bounded. Its walls are still finite. But the view through the window is now partial.
The following table summarizes how Taproot’s structural changes interact with each of the paper’s seven rules:
The boundedness remains. The cardinality is intact. But the geometry has become more complex than the paper’s original framework assumed. The observability gap — the structural opacity of Taproot commitments — is the most visible demonstration of that complexity. It shows that the correspondence between observable boundary and enclosed possibility, which the paper treats as foundational, is no longer exact. The container looks closed. Its interior is partly hidden.
It is important to remember that this strain is output-type specific. A legacy P2PKH output or a SegWit v0 P2WPKH output still satisfies all seven rules mechanically. The bijection between private key and public identity still holds for non-Taproot outputs. The state-space is still fully enumerable for the portion of the UTXO set that predates SegWit version 1. The ledger is not uniformly degraded. It is stratified: a growing layer of Taproot outputs carrying topological complexity, coexisting with a persistent base layer of older outputs that preserve the original geometry.
This stratification would be thermodynamically benign if the two populations never interacted. But Bitcoin’s transaction graph is a single connected structure. A transaction may consume a fully observable SegWit v0 input alongside an opaque Taproot input, producing outputs of either type. When this happens, the entropy of the opaque input enters the same state transition as the transparent input. The ledger record of that transaction is no longer fully enumerable even though one of its inputs was. The observability of the whole is limited by its most opaque component. As Taproot adoption grows, an increasing fraction of all transactions become mixed, and the chain’s global observability degrades not linearly with Taproot’s market share but combinatorially, because every mixed transaction is a bridge across which opacity propagates through the graph.
The seven rules are not an arbitrary checklist. They are the operational expression of a single underlying requirement: thermodynamic conservation in a bounded ledger. Every joule of proof-of-work, every bit of script entropy, every private-key quantum must be accountable within the ledger’s observable state. Pre-Taproot Bitcoin achieved this with an almost mechanical neatness. Every UTXO carried its spending conditions in plain script. The mapping from private key to public identity was bijective. The state-space was fully enumerable: any node could parse every output and know, with certainty, what set of future states each one admitted. The thermodynamic books balanced.
Post-Taproot Bitcoin is a more sophisticated object, but it is not a clean break from what came before. Taproot was activated as a soft fork at block 709,632. It did not invalidate legacy P2PKH, P2SH, or SegWit v0 outputs. Those address types continue to be created and spent today. The result is a mixed ledger: some outputs satisfy all seven rules with mechanical neatness, while others carry the caveats described in the preceding sections. The proportion shifts over time as wallet software defaults migrate toward bech32m, but the coexistence is structural, not transitional. There is no expiration date for P2WPKH.
This means the strains are not universal properties of the current ledger. They are properties of a specific output class that is growing in market share. An auditor examining a random UTXO today may find a legacy output whose script is fully visible, a SegWit v0 output whose witness is transparent, or a Taproot output whose interior is opaque. The observability gap is partial, not total. It is concentrated in the Taproot segment of the UTXO set.
But the two populations are not isolated. Bitcoin’s transaction graph is a single connected structure, and a single transaction can spend inputs of different types together. A transaction may consume a fully observable SegWit v0 input alongside an opaque Taproot input, producing outputs of either type. When this happens, the entropy of the opaque input enters the same state transition as the transparent input. The ledger record of that transaction is no longer fully enumerable even though one of its inputs was. The observability of the whole is limited by its most opaque component.
This entanglement means that the chain’s global observability degrades non-linearly with Taproot adoption. A transaction with even one Taproot input is, for thermodynamic audit purposes, a Taproot transaction. The opacity does not stay contained within the bech32m segment of the UTXO set. It propagates through the graph via mixed spends. As wallet software begins to cluster UTXOs of different types into single transactions — a common coin-selection strategy — an increasing fraction of all state transitions carry hidden degrees of freedom. The clean thermodynamic accounting that applied to legacy outputs in isolation is compromised the moment those outputs are spent alongside Taproot inputs.
The privacy gains are real and significant: indistinguishable key-path spends, hidden script complexity, smaller witnesses. These are not trivial improvements. They protect users from surveillance and reduce chain bloat. But they are purchased with a structural debt that accumulates in the observability layer of the ledger. The debt is not denominated in sats. It is denominated in certainty: the certainty that what the chain reveals is the complete thermodynamic state of the system.
The opening of this article states that the seven rules are structural requirements: remove any one and the ledger ceases to function as a coherent thermodynamic object. Taproot has not removed any of them. Rules 1, 2, and 4 stand intact. Rules 3, 5, 6, and 7 are strained, but they are not void. The ledger still settles value, still prevents double spends, still preserves an irreversible history, still operates within a finite and traversable state-space.
But the paper’s framework makes a stronger claim than the seven rules alone. It defines Bitcoin as a thermodynamically closed object: a system in which “nothing disappears unmeasured; nothing arrives unaccounted for,” and in which the entropy field admits “no hidden microstates.”[1] Closure is the defining property, not a parameter. The seven rules are its operational expression. Taproot does not violate any single rule. It violates the closure that the rules collectively enforce.
This does not make Taproot wrong. It makes it a different kind of object. The paper’s lens reveals what a bounded ledger is when every transformation is registered, every state is enumerable, and every joule of work is accounted for on-chain. Taproot reveals what a bounded ledger becomes when some of that work is moved off-chain, some of those states are hidden, and some of that registration is deferred to the spender’s discretion. Both are real. Both function. They are not the same object, and the framework built for one does not describe the other.
The latent microstates — the prepared script trees, the erased Merkle proofs, the folded key pairs — are not a new category to be added to the framework. The framework is a lens, not a container. It reveals what it is shaped to reveal. Applied to a Taproot output, it reveals a surface that does not match its object. Applied to a legacy P2PKH or SegWit v0 output, it still reveals the closed bounded ledger the paper describes. The two output types are not in conflict. They are simply different objects, and the lens fits one and not the other.
What the article has shown is that the current ledger is a mixture of these two kinds of objects. Pre-Taproot outputs still satisfy the paper’s framework with mechanical neatness. Post-Taproot outputs are a different kind of object, governed by algebraic commitments and selective disclosure rather than full enumeration. The mixed chain is not uniformly described by either view. It is a single ledger containing two ontologies, and the framework applies to one of them.
The two objects differ in where their thermodynamic costs are visible. The object the paper describes accounts for every joule on-chain — entropy traversed, work performed, state resolved — all inscribed, all enumerable, all within the consensus record. Taproot’s object pushes some of that work off-chain. The energy spent building a Merkle tree is real, thermodynamically costly, and invisible to the ledger. An auditor cannot tell what other costs were incurred, what other states were prepared, or what other work was performed. The auditor sees a surface. Behind it, a volume of hidden thermodynamic activity remains unaccounted for.