Theoretical operations per second if every weight unit in every modeled Bitcoin block were devoted to solo anchors versus 64-party OpenCSV batches.
THEORETICAL FULL-BLOCK SATURATION · NOT A NETWORK PROMISE
Summary
7.32 → 15.15
67%
1 proof
Three separate bottlenecks
“Fast” can mean verification work, block-space efficiency, user-visible availability, or settlement. This page keeps those clocks separate.
Fee reduction for 64 participants at 5 sat/vB: 35,596 sats batched instead of 107,904 sats across 64 solo anchors.
GENERATED FROM PINNED RUST FEE MODELA recipient verifies one recursive proof whose size and verification work do not grow with the coin’s transfer history.
IMPLEMENTED · PROOF BYTES STILL TRAVEL OFF-CHAINRecursive proof compression
The entire private asset history is represented by the current proof. Bitcoin receives only a compact binding record and discovery marker; coin openings and proof bytes travel to the recipient.
clock: local proving and verification
Co-funded shared transactions
Participants share one header, marker, and reusable stock path. Every participant still contributes a fee input, payload, and change output, so batching improves capacity about 2.07× at N=64—not 64×.
clock: Bitcoin blocks and fees
Verified unconfirmed chaining
A recipient may use an exact mempool parent after full proof, ownership, layout, binding, and conflict verification. Settlement still arrives only when Bitcoin confirms it deeply enough.
clock: mempool observation → confirmations
48-second animation
The performance model, animated
This animation is conceptual and uses only the generated figures published below. It contains no wallet footage; the real wallet film is on the homepage.
Conceptual Remotion animation · figures generated from the pinned v1 receipt
Shared transactions
One Bitcoin transaction, many independent payments.
The coordinator assembles a transaction but never receives
anyone’s keys. Every signer verifies the exact body and releases only
SIGHASH_ALL.
P1
P2
P3
PN
CO-FUNDED BATCH · ONE SHARED CONTEXT
inputs0: reusable stock · 1…N: participant fee UTXOs
output 064-byte batch header
output 1unspendable discovery marker
output 2unchanged reusable stock
3…N+2participant change, canonical order
witnessN × 24-byte private-payment bindings
What is shared: the transaction’s fixed overhead, marker, header, and stock path. What remains per participant: a fee input, change output, payload, signature, and independently enforced reservation.
Unconfirmed does not mean unchecked
Alice
Signs payment A
Bob
Available—unconfirmed
Carol
Receives payment B
The asset can move again before Bitcoin settles.
This is a logical OpenCSV dependency chain. Each payment normally uses its own Bitcoin fee UTXO; Bob does not spend Alice’s Bitcoin anchor output.
Persists proof and exact anchor transaction before broadcast.
verified parent
txid A
txid A
Proof, ownership, binding, layout, RBF policy, and confirmed-history exclusion all pass.
logical child
separate fee UTXO
separate fee UTXO
B records A as a dependency and rechecks A immediately before signing.
Failure is explicit. If exact parent A
disappears or is replaced, Bob’s dependent coin is removed from selection
immediately, provenance is frozen durably, and the UI moves to “needs
attention.” A later settled replay is the only normal thaw path.
The sender does not wait on proving.
Signal acknowledges only a durable payment intent, labels it pending and
non-spendable, then returns to chat. Proof generation, backup protection,
signing, relay, and proof-bearing attachment delivery resume in background
under the same operation id. This makes the interface immediate without
treating a promise as a coin: the recipient still needs the proof and the
exact parent transaction before value becomes available.
Reproduce the economics
Change the group size and fee market.
The calculator reads the same versioned JSON receipt checked against the pinned Rust implementation in CI.
Marker cost is modeled as 546 sats. The reusable stock principal is returned and is not counted as a fee.
Solo total107,904 sats
Batch total35,596 sats
Savings67.0%
Per participant556–557 sats
Batch weight28,040 WU
Full-block upper bound15.15 ops/s
Loaded from the published v1 receipt.
| Participants | Batch WU | Solo total | Batch total | Savings | Upper bound |
|---|---|---|---|---|---|
| 1 | 1,391 | 1,686 | 2,286 | −35.6% | 4.79 ops/s |
| 2 | 1,814 | 3,372 | 2,816 | 16.5% | 7.35 ops/s |
| 4 | 2,660 | 6,744 | 3,871 | 42.6% | 10.02 ops/s |
| 8 | 4,352 | 13,488 | 5,986 | 55.6% | 12.25 ops/s |
| 16 | 7,736 | 26,976 | 10,216 | 62.1% | 13.79 ops/s |
| 32 | 14,504 | 53,952 | 18,676 | 65.4% | 14.67 ops/s |
| 64 | 28,040 | 107,904 | 35,596 | 67.0% | 15.15 ops/s |
Capacity uses 4,000,000 WU and a 600-second modeling
interval. Solo saturation is 7.32 ops/s from
floor(4,000,000 / 911) / 600. Real Bitcoin throughput is shared
by everyone and varies with actual transaction mix and block timing.
Limits
Not instant Bitcoin finality.
Not a 64× TPS multiplier.
Not a rollup or global state machine.
Not a general Bitcoin wallet.
Not free privacy.
Not yet one transaction for sequential hops.
What this design does not claim
Instead: explicit provisional availability followed by native Bitcoin confirmation depth.
Instead: about 2.07× theoretical raw L1 operation capacity at N=64, with much larger fee amortization.
Instead: recipients verify their own coins and Bitcoin supplies ordering and availability.
Instead: BTC is restricted to OpenCSV protocol fees, controlled and signed in Rust.
Instead: proof contents remain private, while batch membership, fee inputs, change scripts, and timing can be observable.
Instead: current child payments use separate Bitcoin fee anchors and an explicit dependency graph.
Receipts
Measured and live results
IMPLEMENTED · REGTEST RECEIPT
Co-funded batch and unanimous RBF
Two real participant fee UTXOs, mutated-output rejection, signed replacement, broadcast, mining, BIP158 discovery, and persistent envelope indexing.
Read the frozen protocolMEASURED · PRODUCTION PROFILE
History-independent verification
V3 records the two-input shapes. V4 adds a one-input forwarding shape measured end to end on a physical iPhone 16e: 6.435 seconds to prove, 19.75 ms to verify, and 788,047 bytes.
Open the exact v4 benchmark receiptLIVE · SIGNAL RECEIVE
Exact unconfirmed parent accepted
A cold phone-owned signet scan accepted one still-unconfirmed mint, persisted unconfirmed finality, and deduplicated two deliveries of the same 536,279-byte attachment.
Read the journal receiptLIVE · ZERO-CONFIRMATION CHILD
Real unconfirmed parent and child
Carol sent 1 Test USD to Bob; while that Bitcoin transaction was still unconfirmed, Bob verified and spent its exact OpenCSV coin back to Carol. Both pinned APIs returned identical bytes for both parent and child before either confirmed. Local proofs took 6.096s and 5.995s; signing and persistence took 23ms and 18ms. Each operation survived a post-broadcast relaunch; protocol credit remained deduplicated at that checkpoint.
A fresh 45/10 Test USD repeat again spent an unconfirmed parent into an unconfirmed child. Both required observers matched exact bytes; both transactions later settled together at height 316824. The wider audit found follow-up fixes in Signal PR #8 and Rust PR #16. Both are merged; Signal PR #9 pins the Rust fix, with its post-merge default Xcode job still an explicit fix-forward gate.
Inspect the fresh child transactionLIVE · SHARED SIGNET TRANSACTION
Two Signal recipients, one Bitcoin transaction
Carol sent 5 Test USD to Bob and 5 to Note to Self under one frozen
batch. Both envelopes share txid 771aefc6…03c4c3 and their
exact manifest positions. Both pinned observers matched the raw bytes;
the 908-sat, 1,808-WU transaction settled at height 316687.
LIVE · PROTOCOL-SAFE RBF
One payment, two exact anchor receipts
A 1 Test USD payment moved from 2 to 5 sat/vB while preserving its
funding input, record, marker, context, output positions, and delivery
identity. Both observers see replacement 4ae0f1c6…cbd7f7
and no longer find the original. Signal credits and renders one payment
while retaining both proof-bearing attachments. The replacement
confirmed at signet height 316803.