How PATINA works

An artifact points at exactly one unspent output, its carrier. For a live artifact at chain height H:

Depth is computed at query time and never stored per block, so there is no counter to drift and nothing to update. Spending the carrier destroys it, and a destroyed output has no height to subtract from. That is the entire reset mechanism. It is inherited from the UTXO model, not enforced by anyone.

• The push must be a single minimal data push. Multiple pushes, non minimal pushes, or extra opcodes make the marker inert. It still occupies the marker slot of its transaction, so a malformed marker cannot be hidden behind a well formed one further along.
• The protocol marker of a transaction is the OP_RETURN output with the lowest vout index whose payload starts with PTNA.
• If more than one output carries a payload starting with PTNA, the marker is void with reason VOID_DUPLICATE_MARKER and the default rule applies as if no marker were present.
• The whole scriptPubKey stays at or below 83 bytes.

A qualifying commit is a taproot output whose spend reveals the reduced-data leaf below or its permanent legacy encoding.

The signature check makes the claim unstealable. Pushing and dropping the commitment afterwards leaves that result unchanged and executes no conditional opcode.

The legacy 70 byte OP_0 OP_IF ... OP_ENDIF leaf stays parseable forever, so commits already confirmed under it are never stranded. New construction does not use it, because reaching an OP_IF at all is what BIP-110 rules out.

The leaf must be revealed in the SEED transaction's own witness, as a script path spend.

The marker has to decode as a SEED before any of this runs. A push of the wrong length, a push that is not minimal, a trailing byte, or a non zero flags byte is SEED_BAD_GRAMMAR and the transaction creates nothing.

An artifact is founding when its commit output was created inside the window, meaning h_open is less than or equal to the commit height and the commit height is below h_close, and the reveal lands at or before h_close plus the 4032 block grace period.

The mint page walks the same two transactions from the claimant's side.

Any confirmed spend of a carrier closes the stretch. The record gains a ring, and the artifact either continues on a successor output at depth zero, or ends.

Rings are appended and never edited. An artifact at depth 40 today can still carry a ring from a stretch of four years, so a low depth now says nothing about what that artifact has already done. Depth and rings, in full.

reveal_txid_wire is the txid in internal byte order, which is the reverse of the txid your block explorer shows you. Display ids are lowercase hex. The attestation message is signed off chain with BIP-322, which is how a holder shows that the key behind a carrier is still alive.

Two indexers that agree on the state root at a height agree on everything below it. Verify an artifact yourself shows how to compare them.

PATINA state is a pure function of the confirmed chain read in block order. There is no state that exists outside the blocks, so a reorg needs no special handling beyond replaying.

• An indexer disconnects the orphaned blocks, discards every event they produced, and applies the new blocks in order.
• An artifact created by a reveal that got orphaned stops existing until that reveal confirms again. If it confirms in a different transaction, its id changes too, because the id is derived from the reveal txid.
• A ring closed by a spend that got orphaned reopens, and the stretch continues from the original carrier height.
• Depth is never stored per block, so nothing has to be recomputed backwards. It is always the current height minus the carrier height.
• Founding status can change across a reorg if the commit output's height moves across a window boundary. This is why the grace period exists and why claims near the edges deserve patience.

At six confirmations the reference implementation reports a PATINA fact as final, and below six it reports it as pending. That is a reporting convention, not a consensus rule. Bitcoin decides, and PATINA reads.

A rejected marker is never dropped in silence. The registry is frozen, and the order below is the registry order.

The tier ladder, the marker grammar and the entry ceiling are frozen in the specification. The window heights and the carrier minimums arrive through a deployment record instead. An indexer that loads a different record produces a different history from the same blocks, which is why the record is part of the input and not part of the code.