Every rule, numbered,
and traced to the frozen bytes.

A deployment binding consists of exactly one Bitcoin network code, one configured INIT txid on that network, and the SHA256 digest of the raw bytes of the specification file. The binding is immutable for one protocol identifier. tandem.md section 3

An implementation MUST NOT select an INIT by first-seen order, lowest txid, block order, or marker discovery. An alternate INIT txid defines an alternate protocol identifier even when its payload fields are identical. tandem.md section 3

The network codes are fixed.tandem.md section 3

The protocol identifier and the object display identifier are exactly: tandem.md section 3

tndm:<network_label>:<configured_init_txid_display>

tandem:<network_label>:<configured_init_txid_display>:<create_txid_display>:1

The trailing 1 is decimal vout 1, the carrier output.

The namespace commitment binds network, INIT, and specification bytes into one 32-byte value. It can be derived before INIT validation, but only a valid confirmed configured INIT activates state under it. tandem.md section 3

namespace_commitment = SHA256(
  "TANDEM/NAMESPACE\0" ||   // 17 bytes
  network_u8 ||             // 1 byte
  configured_init_txid_wire32 ||
  spec_hash32
)

For a valid CREATE at vout 1, the binary object key is derived once and never changes. Binary object keys, not display identifiers, are used for equality, ordering, database keys, event roots, and object-state roots. tandem.md section 3

object_key = SHA256(
  "TANDEM/OBJECT\0" ||      // 14 bytes
  namespace_commitment ||
  create_txid_wire32 ||
  uint32_le(1)
)

An output is a Tandem marker candidate when all of the following can be established from its script bytes: the first opcode is OP_RETURN (0x6a); the next opcode is a direct data push from 0x01 through 0x4b or one of OP_PUSHDATA1, OP_PUSHDATA2, OP_PUSHDATA4; the declared pushed data is at least four bytes; at least the first four declared data bytes are physically present; and those four bytes are 54 4e 44 4d, ASCII TNDM. tandem.md section 6.1

Candidate status deliberately does not require a minimal push, a complete declared payload, a known marker format, a known opcode, an exact operation length, zero output value, or the absence of trailing script bytes. Those are validation conditions. The broad candidate rule makes malformed markers deterministic and stops a second malformed marker from evading MULTIPLE_MARKERS. tandem.md section 6.1

If byte offset 6 of a candidate payload is present and equals 0x00, the candidate is an INIT candidate. An INIT candidate in any transaction other than the configured INIT txid is foreign to this protocol identifier and is removed before marker counting. It emits no event by itself. If that transaction also spends an active carrier, processing continues as though the foreign candidate were absent. tandem.md section 6.1

A valid marker output has value zero, and its script contains exactly OP_RETURN, one minimal data push, and one exact payload, with no trailing opcode or byte. Every valid operation has exactly one marker candidate, at vout 0, and no other OP_RETURN output. tandem.md sections 6.2

These are the only valid encodings.tandem.md section 6.2

For a structurally readable candidate the parser first enforces, in order: a complete push-length prefix; no payload shorter than seven bytes or longer than 80 bytes; declared push length equal to the physically present payload length; no bytes after the pushed payload; minimal push encoding; and, if opcode byte 6 is defined, the exact payload length for that opcode regardless of the marker-format byte. Failure of any item is BAD_MARKER_ENCODING_OR_LENGTH. A structurally valid payload with an undefined opcode may be any length from 7 through 80 and reaches marker-format and opcode validation. tandem.md section 6.2

All five payloads share the same first seven bytes: magic TNDM, marker format 0x01, the bound network code, and the opcode. tandem.md section 7

The remaining payload fields are exact.tandem.md sections 7.1 to 7.5

REFUND has no marker and no payload. CREATE and ROTATE never duplicate keys in the payload: the keys are the ones revealed by their inputs.

The MARK kinds and CLOSE reasons are closed sets.tandem.md section 4

No other opcode, kind, reason, flag, marker format, network byte, state vout value, or reserved value is defined in Tandem.

The two carrier keys MUST be valid, distinct, compressed secp256k1 points, each exactly 33 bytes beginning with 0x02 or 0x03, sorted by unsigned bytewise lexicographic order so that key0 < key1. Side A is always key0. Side B is always key1. tandem.md section 5.2

The witness script is exactly this, and exactly 71 bytes. Its native P2WSH scriptPubKey is OP_0 PUSH32 SHA256(witnessScript), 34 bytes serialized. tandem.md section 5.2

OP_2 PUSH33 key0 PUSH33 key1 OP_2 OP_CHECKMULTISIG

52 21 <key0_33> 21 <key1_33> 52 ae

A carrier input has an empty scriptSig and exactly four witness elements, in this order. The first element MUST be empty. The first signature MUST verify for key0 and the second for key1. tandem.md section 5.2

<empty> <signature_for_key0_plus_01> <signature_for_key1_plus_01> <witnessScript>

Both signatures MUST be strict DER and low-S excluding the final sighash byte, MUST end in 0x01 for SIGHASH_ALL, and MUST verify under SegWit v0 signature hashing using the exact prevout amount.

A required native P2WPKH input has an empty scriptSig and exactly two witness elements, <DER_signature_plus_01> <compressed_public_key>. The key's HASH160 MUST equal the witness program in the spent prevout. tandem.md section 5.1

MARK, ROTATE, and CLOSE MUST carry a marker state_seq exactly equal to the consumed predecessor's sequence plus one. A predecessor sequence of 0xffffffff cannot be incremented and fails. REFUND and a terminal EXITED_NONCANONICAL event do not increment, so either may terminate a carrier that is already at 0xffffffff. tandem.md sections 9.3, 9.4, 9.5, 11.3

A MARK MUST reproduce the predecessor carrier scriptPubKey byte for byte at vout 1. A ROTATE MUST place at vout 1 the exact carrier P2WSH derived from the successor pair. A ROTATE successor pair MUST differ from the old pair in at least one key, and MUST itself satisfy PAIR-1. tandem.md sections 9.3, 9.4

CLOSE and REFUND MUST pay key0 and key1 at native P2WPKH outputs whose values are exactly equal and strictly positive. Neither side can end the object on better terms than the other. tandem.md sections 9.5, 9.6

INIT

The configured INIT is valid only when its txid is the externally configured INIT txid and it is confirmed on the bound network; version 2, locktime 0; exactly one input and two outputs; vin 0 sequence 0xffffffff; vin 0 spends a native P2WPKH prevout confirmed in an earlier block, reveals its bound compressed key, and carries a valid SIGHASH_ALL signature; vout 0 is the exact zero-value INIT marker; vout 1 is native P2WPKH to the vin 0 key and at least 1,000 satoshis; the input value minus vout 1 is the complete fee and is positive; the marker network is the bound network; carrier_value is 20,000 and refund_delay is 52,560; spec_hash is SHA256 of the exact specification bytes; H_open + 4320 fits u32 and equals H_close; and INIT_confirmation_height + 1008 is computed without overflow and is at most H_open. tandem.md section 9.1

There is no in-place replacement. If the configured INIT is absent, orphaned, conflicted away, or invalid, this protocol identifier is not activated.

CREATE

A CREATE is valid only when the configured INIT is valid and on the active chain; version 2, locktime 0; exactly two inputs and four outputs; both input sequences 0xfffffffd; each input spends a native P2WPKH prevout confirmed in an earlier block; the key revealed by vin 0 is key0 and by vin 1 is key1, satisfying PAIR-1; vout 0 is the exact zero-value CREATE marker; vout 1 is exactly 20,000 satoshis to the exact carrier P2WSH; vout 2 is native P2WPKH to key0 and vout 3 to key1, each at least 1,000 satoshis; there is no extra data, payment, marker, input, or output; the fee arithmetic in section 3.3 holds; and the CREATE confirmation height is at or above H_open. tandem.md section 9.2

A valid CREATE at height h creates sequence 0. It is founding exactly when H_open <= h < H_close. A valid CREATE at or after H_close creates an ordinary, nonfounding object. A CREATE before H_open is invalid.

MARK

Version 2, locktime 0; exactly two inputs and three outputs, both sequences 0xfffffffd; vin 0 spends the one active predecessor carrier, confirmed in an earlier block, satisfying PAIR-3 with the current key pair; vin 1 spends one native P2WPKH fee-sponsor prevout confirmed in an earlier block, whose key equals current key0 or current key1; vout 0 is the exact zero-value MARK marker; the marker state_seq satisfies PAIR-5; the kind is defined, flags is zero, and the chapter commitment is not all zero; vout 1 is exactly 20,000 satoshis to a P2WSH script identical byte for byte to the predecessor carrier scriptPubKey; vout 2 is native P2WPKH to the sponsor key and at least 1,000 satoshis; and the sponsor fee is positive. tandem.md section 9.3

A valid MARK appends exactly one chapter, increments sequence by one, retains the current keys, and makes (txid,1) the active carrier.

ROTATE

Version 2, locktime 0; exactly three inputs and four outputs, all sequences 0xfffffffd; vin 0 spends the one active predecessor carrier, confirmed in an earlier block, satisfying PAIR-3 with the old pair; vin 1 and vin 2 each spend a native P2WPKH prevout confirmed in an earlier block, revealing successor key0 and successor key1 respectively, satisfying PAIR-1 and PAIR-6; vout 0 is the exact zero-value ROTATE marker; state_seq satisfies PAIR-5; vout 1 is exactly 20,000 satoshis to the exact successor carrier P2WSH; vout 2 and vout 3 are native P2WPKH to successor key0 and successor key1, each at least 1,000 satoshis; and the fee arithmetic in section 3.3 holds. tandem.md section 9.4

A valid ROTATE increments sequence by one, replaces the current keys with the successor keys, preserves chapter count, and makes (txid,1) the active carrier.

CLOSE

Version 2, locktime 0; exactly one input and three outputs; vin 0 sequence 0xfffffffd; vin 0 spends the one active predecessor carrier, confirmed in an earlier block, satisfying PAIR-3 with the current pair; vout 0 is the exact zero-value CLOSE marker; state_seq satisfies PAIR-5; the reason is defined and all three reserved bytes are zero; vout 1 is native P2WPKH to current key0 and vout 2 to current key1, with exactly equal, strictly positive values; and the remaining fee is positive. tandem.md section 9.5

A valid CLOSE increments sequence by one, creates no successor, retains the last current keys, and terminates the object with status CLOSED.

REFUND

REFUND is recognized only through the markerless dispatch branch. Version 2, locktime 0; exactly one input and two outputs; no OP_RETURN output; vin 0 spends the one active carrier and satisfies PAIR-3 with the current pair; vin 0 sequence is exactly decimal 52,560, numeric value 0x0000cd50, serialized 50 cd 00 00, with the BIP68 disable and type flags clear; vout 0 is native P2WPKH to current key0 and vout 1 to current key1, with exactly equal, strictly positive values; the remaining fee is positive; and Bitcoin consensus relative-locktime rules consider the input mature in the containing block. tandem.md section 9.6

The relative delay starts at the confirmation height of the exact carrier being spent. Every confirmed MARK or ROTATE replaces the carrier and restarts the delay. A valid REFUND does not increment state_seq; it records the current sequence, creates no successor, retains the current keys, and terminates the object with status REFUNDED. Every REFUND validation failure collapses to the single stable reason BAD_REFUND_SHAPE_OR_MATURITY.

The complete set of transitions is exactly this. There are no others.tandem.md section 10

no object --valid CREATE--> ACTIVE sequence 0
ACTIVE    --valid MARK----> ACTIVE sequence + 1, chapter_count + 1
ACTIVE    --valid ROTATE--> ACTIVE sequence + 1, successor keys
ACTIVE    --valid CLOSE---> CLOSED sequence + 1
ACTIVE    --valid REFUND--> REFUNDED, sequence unchanged
ACTIVE    --any other confirmed carrier spend--> EXITED_NONCANONICAL, sequence unchanged

Any confirmed transaction that consumes an active carrier but does not validate as one allowed operation MUST atomically terminate that object as EXITED_NONCANONICAL. The spend is not ignored, because the active UTXO no longer exists. If one transaction consumes several active carriers, every consumed object terminates. Tandem never combines, splits, or forks objects. tandem.md section 10

Terminal objects never become active again except by a reorganization of the active chain that removes their terminal spend. CLOSED, REFUNDED, and EXITED_NONCANONICAL have no Tandem successor operation. tandem.md section 10

For each object: the genesis outpoint is permanently its valid CREATE outpoint (create_txid,1); sequence starts at 0; MARK, ROTATE, and CLOSE require and record exactly predecessor sequence plus one; REFUND and a terminal EXITED_NONCANONICAL event both retain the predecessor sequence; an active object has exactly one current outpoint, one sorted current key pair, carrier value 20,000, and the greatest valid state sequence; a valid MARK alone increments chapter_count; a terminal object has no current outpoint, retains its last key pair and sequence, and records its terminal txid; and invalid no-state events never mutate an object or a counter. tandem.md section 10

A valid CREATE is founding exactly when its confirmation height on the active chain lies in [H_open, H_close). Founding status is immutable while that CREATE remains at that height. A reorganization can remove the CREATE or change its height, and therefore its founding status. tandem.md section 10

The three post-block counters are exactly:tandem.md section 10

• founding_created: all valid CREATE objects on the active chain whose CREATE height is in [H_open, H_close), including terminal objects.
• all_objects: every valid CREATE on the active chain at or after H_open, including founding, ordinary, active, and terminal objects.
• active_objects: every object whose post-block status is ACTIVE.

CLOSE, REFUND, and a terminal EXITED_NONCANONICAL event reduce only active_objects. A reorganization may change any counter. Mempool transactions never change protocol state or counters.

A conforming implementation MUST preserve every invariant in tandem.md section 15, including that one binary object key maps to exactly one valid CREATE outpoint and one status; a valid outpoint on the active chain is consumed at most once; a chapter is unique by (object_key, state_seq); a carrier represents one jointly controlled object and is counted once, not once per key; and founding status depends only on the CREATE confirmation height on the active chain. tandem.md section 15

Given the same deployment binding, the same exact specification bytes, and the same blocks on the active chain, independent implementations MUST produce identical events, reason codes, state, counters, event roots, object-state roots, and chained roots at every height. This is the invariant the two-pipeline agreement procedure exists to test. tandem.md section 15, invariant 12

For each confirmed transaction in scope, perform these steps in order. tandem.md section 11.2

1. Find all marker candidates by REC-1.
2. Remove foreign INIT candidates by REC-3.
3. If this is the configured INIT txid and no marker remains, emit one class 0 event with reason BAD_MARKER_ENCODING_OR_LENGTH, event type INVALID, event_index 0xffffffff, and stop. The INIT fails.
4. Join every input prevout against active object state as it exists immediately before this transaction in block transaction order. The matches are the carrier spends.
5. If more than one marker remains, stop ordinary validation. With no carrier spend, emit one class 0 MULTIPLE_MARKERS event. Otherwise emit one class 2 terminal event per carrier spend, all with reason MULTIPLE_MARKERS, and terminate those objects.
6. If more than one active carrier is spent, emit one class 2 terminal event per carrier with reason MULTIPLE_CARRIERS and terminate them. This applies whether zero or one marker remains.
7. If no marker remains and exactly one carrier is spent, inspect shape. With exactly one input and two outputs, dispatch only to REFUND recognition: a match emits REFUND, any failure emits one terminal BAD_REFUND_SHAPE_OR_MATURITY. Otherwise emit one terminal UNMARKED_CARRIER_SPEND.
8. If no marker remains and no carrier is spent, emit no event.
9. If exactly one marker remains, parse and validate it. The configured INIT txid requires opcode INIT; a different defined opcode is a fixed-field failure; an undefined opcode remains UNKNOWN_OPCODE.
10. A valid operation emits its valid event and applies its exact state delta.
11. An invalid single-marker transaction with no carrier spend emits one class 0 event and no state delta.
12. An invalid single-marker transaction with one carrier spend emits one class 2 EXITED_NONCANONICAL event, records the selected validation reason, and terminates the consumed object.

Dispatch steps 5 through 7 take precedence over numeric reason-code order. A transaction with multiple markers and multiple carriers therefore receives MULTIPLE_MARKERS, while a transaction with one or zero markers and multiple carriers receives MULTIPLE_CARRIERS. tandem.md section 11.2

Within a selected single-marker operation, evaluate safely testable conditions in ascending reason-code order and return the lowest failing code. A parser MUST NOT guess a field that cannot be decoded. A state-dependent comparison that cannot be made because no active predecessor exists is deferred to PREDECESSOR_NOT_ACTIVE; independent earlier checks remain testable. tandem.md section 11.3

Three tie-breaks are called out explicitly. For MARK and ROTATE, a vout 1 amount other than 20,000 is BAD_OUTPUT_SCRIPT_OR_VALUE; only once the amount is valid does a wrong successor script become BAD_SUCCESSOR. For CREATE, a wrong vout 1 carrier script is BAD_OUTPUT_SCRIPT_OR_VALUE. CLOSE and REFUND equality failures are fee-split failures, assigned after their output destinations and positive fee are established. tandem.md section 11.3

This registry is exhaustive. Names and numeric values are permanent within Tandem. VALID is used only for a recognized valid operation. tandem.md section 12

Each event contributes one leaf. Order leaves by the tuple (tx_index, event_index, sub_index), comparing each unsigned integer numerically. tandem.md sections 13.2, 14.1

SHA256(
  "TANDEM/EVENT\0" ||        // 13 bytes
  namespace32 || block_hash_wire32 || height_u64le ||
  tx_index_u32le || event_index_u32le || sub_index_u32le ||
  event_type_u8 || validity_class_u8 || reason_u16le ||
  txid_wire32 || wtxid_wire32 || object_key32 ||
  state_seq_u32le || predecessor_outpoint36 || successor_outpoint36 ||
  key0_33 || key1_33 || commitment32
)

The field block after the domain tag is exactly 358 bytes. See the errata for the total preimage length.

After applying all transactions in a block, every surviving object contributes exactly one snapshot leaf. Order object leaves by unsigned bytewise lexicographic object_key32. tandem.md section 14.2

SHA256(
  "TANDEM/OBJECT-STATE\0" || // 20 bytes
  object_key32 || founding_u8 || status_u8 ||
  create_height_u64le || state_seq_u32le || current_outpoint36 ||
  key0_33 || key1_33 || terminal_txid_wire32 || chapter_count_u32le
)

Active objects use their active carrier as current_outpoint36 and zero32 as terminal txid. Terminal objects use zero36 as current outpoint, retain their last keys and sequence, and record the txid of CLOSE, REFUND, or the carrier spend that terminated it.

Both Merkle trees duplicate an unpaired final hash at every level and hash it with itself. One leaf is its own root with no additional node hash. tandem.md sections 14.1, 14.2

An empty event set for a block hashes "TANDEM/EVENT-EMPTY\0" || namespace_commitment; an empty object set hashes "TANDEM/OBJECT-EMPTY\0" || namespace_commitment.

The chained root links every block on the active chain from the configured INIT confirmation block onward, including blocks with no Tandem event. The root immediately before that block is SHA256("TANDEM/STATE-EMPTY\0" || namespace_commitment). tandem.md section 14.3

R_h = SHA256(
  "TANDEM/BLOCKROOT\0" ||    // 17 bytes
  namespace_commitment || R_prev || block_hash_wire32 || height_u64le ||
  event_root32 || object_state_root32 ||
  founding_created_u64le || all_objects_u64le || active_objects_u64le
)

R_h becomes R_prev for the next block on the active chain. Each counter is the post-block value. Connecting a block applies transactions in transaction-index order, records events, applies state deltas atomically, computes both component roots and counters, then computes the chained root. Disconnecting a block reverses its state mutations and roots in exact reverse order before a replacement branch is applied.