Risks, PATINA

01 What the number means

Depth is a fact about an output, not a biography of a person.

Depth is a subtraction between two block heights. That makes it exact, and it also makes it narrow. Here is what it refuses to tell you.

Depth is not provenance

Depth proves one thing: this outpoint has not moved since a specific height. It does not prove that the same person controlled it for that whole time. Private keys can change hands off chain with nothing recorded anywhere, and no protocol on Bitcoin can see that.

A signed attestation over the artifact id and a recent block hash adds one more fact, that the key is alive right now. It still says nothing about the years before. Whoever holds the key today can sign it, including someone who bought the key yesterday.

Depth cannot tell discipline from loss

An output that has not moved for four years might belong to someone with conviction, or to someone who lost the seed phrase the week after they claimed it. The chain sees the same thing either way. Some of the deepest artifacts that ever exist will be ones nobody can spend.

02 Before you pay for one

The founding cohort has no cap, and a purchase starts the count again.

Founding membership can be concentrated

Anyone willing to park real bitcoin can claim as many Firstlight Seals as they can fund. There is no cap, no allowlist and no per person limit, because the protocol has no concept of a person. A single well funded participant could hold a large share of the founding cohort.

We publish live concentration figures during the window rather than after it. That does not prevent farming. It only means you find out while you can still decide what to do about it.

Buying one resets it

A transfer is a Bitcoin spend, which destroys the carrier. The stretch you were paying for closes as a ring, and the artifact restarts at depth zero on the new output. You inherit the record of what happened. You do not inherit the depth.

If somebody offers you a deep artifact, what you can actually buy is a deep set of rings and a fresh stretch. Price it that way, and read what a ring records before you agree a number.

03 Accidents

Four ways to end a stretch without meaning to.

Nothing in ordinary Bitcoin software knows what a carrier is. A routine spend is enough, and the chain will not ask you twice.

Coin selection picked the carrier because it was a coin. The default rule then handed the artifact to the lowest index output that could hold it, which is the one you were paying, not the one coming back to you.

Your own wallet

Ordinary coin selection knows nothing about carriers. A wallet consolidating dust, paying a fee from the wrong coin, or sweeping an address will spend a carrier without a warning, and the stretch ends there. The default rule then hands the artifact to the lowest index output that can hold it, which in an ordinary payment is the person you paid.

Check outpoints against the safety endpoint before you spend, or keep carriers in a wallet you never sweep. How to check.

Change below the floor

The default rule needs an output holding at least 10 000 sats that is not an OP_RETURN. A spend that leaves only smaller outputs finds no eligible successor, and the artifact becomes a relic. Terminal, immediately, with no way back.

Bundles move together

Several artifacts can ride one carrier. A KEEP entry names an input rather than an artifact, so every artifact on that carrier takes the same routing decision. No transaction can send one of them to one output and the rest to another, and the spend that moves any of them closes a stretch on all of them.

A void marker

Write a marker the indexer cannot read and it is discarded, not corrected. The default rule then applies as if you had written nothing, and the successor may not be the output you had in mind.

Void has two sizes

Nothing here is an error you get to fix in the next block. The transaction is already confirmed and the default rule has already chosen a successor. What changes between these cases is how much falls through: the whole marker, or one entry inside it.

Two outputs carry a PTNA payload: The whole marker is void. Every carrier the transaction spends follows the default rule, as if you had written nothing at all.
The KEEP payload does not decode: A count outside 1 to 8, the wrong payload length, a push that is not minimal, or two entries naming the same input. These are decode failures, so the whole marker is inert and every spent carrier falls to the default rule.
An entry names an input that is not a carrier: That entry is void, and the other entries still stand. The input it named, if it was carrying anything at all, falls to the default rule on its own.
An entry names a vout that is missing: That entry is void. It has to point at an output the transaction actually created.
An entry names an OP_RETURN: That entry is void. An OP_RETURN cannot hold an artifact, so it cannot be a successor.
An entry names an output under 10 000 sats: That entry is void. The successor minimum is 10 000 sats, and an entry below it routes nothing, while the rest of the marker is applied as written.

Every way depth resets, in order The marker grammar and the default rule

04 At mint time

The gap between commit and reveal is where claims are lost.

There are at least 144 blocks between the two transactions. A day is long enough for the mempool, the chain and your attention to move.

A commit that is never revealed creates nothing: The commit output only holds a commitment. No artifact exists until the reveal confirms, and the coins stay yours the whole time, because only your key can spend that output.
A reveal after the grace period is not founding: Founding needs the commit height inside the window and the reveal at or before the grace end, 4032 blocks after the window closes. A later reveal still creates an artifact, just an open era one, held to the 10 000 sat carrier minimum instead of 100 000.
Fees can spike between the two transactions: By the time you are allowed to reveal, your commit is published and your plan is fixed. The fee that looked comfortable when you committed is not the fee that has to get the reveal confirmed, and there is no way to go earlier: a reveal below the minimum age is rejected outright.
A reveal that fails a check creates nothing: It records an invalid event with a reason code, and you have paid a fee for it. Read the reason codes before you build anything by hand.
Reorgs near a window edge can change founding status: If the commit output's height moves across the open or close boundary in a reorg, the founding flag moves with it. Six confirmations is where the protocol reports a fact as final, and a claim sitting on a window edge deserves more patience than that.
A reorg can change the artifact id: The id derives from the reveal txid, so if the reveal is replaced by a different transaction the id is different too.

Walk through the mint before you spend anything

05 Out of your hands

What happens when the software, the company, or the interest goes away.

What can go wrong further out, and what it would actually do.
Risk	What it would mean
An indexer is wrong	State is derived, so a bug shows up as a disagreement with a node or with another indexer. Depth from `gettxout` is the check that settles it. This is why the verify page exists.
Every indexer goes offline	Your artifact is unaffected. It is an unspent output at a known height. Anyone can rebuild the index from the chain, because nothing lives outside the blocks.
Bitcoin Universe shuts down	The app's tab disappears. The protocol does not. Anyone can build markers and index them with no permission from us.
A bug in this software	This is new code. Test vectors and a frozen specification reduce the chance of two implementations disagreeing, but they do not make bugs impossible. Deviations get recorded in the repository rather than quietly patched.
Nobody else cares	There is no market maker, no liquidity commitment, no floor and no obligation on anyone to buy. An artifact may be worth nothing to anyone but you, forever. That is the honest base case for anything new.
Regulatory and tax treatment	Unsettled and jurisdiction specific. Spending a carrier is a Bitcoin transaction, and how that is treated where you live is a question for someone qualified to answer it. Nothing on this site is advice.

06 Where the list ends

What ownership actually guarantees.

The whole guarantee

That the record is readable, that the rules were applied the same way to everyone, and that nobody can alter your artifact without your key. That is the complete list. It does not include value, liquidity, attention, or a future.

Every way this can let you down.