Nakamoto Consensus has an invariant core and a variable layer. SegWit layered the dark universe into the same block. The fee market cannot tell them apart.
A Bitcoin transaction is two points in a finite keyspace, separated by distance in block-time and locality in memory, carrying a magnitude of satoshis relative to a deterministic supply.
Formally: let kin and kout be 256-bit key coordinates on the secp256k1 curve. Let Tin and Tout be the block heights at which the input UTXO was created and the output UTXO is committed. Let S(t) be the deterministic total supply at height t. The transaction vector v is:
where ΔM is the satoshi magnitude, bounded by the supply at each endpoint: 0 ≤ ΔM ≤ S(Tin) at the input, and 0 ≤ ΔM ≤ S(Tout) at the output. The magnitude is conserved across the transition. Nothing is created or destroyed. The vector simply moves value from one coordinate to another in keyspace-time.
This is the atom of Nakamoto Consensus. Not a database row. Not a message. A thermodynamic event: two points in a vast but bounded coordinate system, separated by time and locality, carrying a conserved magnitude. The proof-of-work that commits this vector to the ledger is the energy that makes the transition irreversible. The satoshi is the witness of that irreversibility.
Layer 0 is the invariant core of Bitcoin. It defines the coordinate system, the magnitude bound, the temporal quantum, and the conservation law. If any of these change, the system is no longer Bitcoin. L0 is the visible universe: every byte is priced at 1×, every byte is visible to every validator, the satoshi and the byte are unified.
The L0 invariants:
21 million supply cap. The magnitude bound. S(t) is a monotonically non-decreasing function that converges to 2,099,999,999,755,528 satoshis. No valid state transition may increase this cardinality.[1] This is Rule 1 of the bounded ledger.
One block = one tick of time. The temporal quantum. Between ticks, the system does not partially advance. There is no fractional block, no intermediate state of memory inscription. Either entropy has been collapsed and memory written, or it has not.[2]
SHA-256 proof-of-work. The energy-to-entropy conversion. The miner searches a difficulty-scaled nonce space; the block that emerges is the irreversible resolution of that search. The energy is conserved in the block header.
secp256k1. The coordinate system. Every public key is a point on this elliptic curve. Every address is a hash of that point. The keyspace is bounded at approximately 1.1579 × 1077 keys.[3]
The UTXO model. The structural unit of memory. A UTXO is a discrete, indivisible commitment of value to a key coordinate at a specific block height. It cannot be partially spent. It exists or it does not.
Script validation. The spend authorization rules. A UTXO can only be spent if the witness satisfies the encumbrance conditions defined in its script. This is the conservation law for value transitions.
The 1 MB write authority. The rate limiter on memory creation per tick. Before SegWit, the protocol enforced a raw-byte cap of 1,000,000 bytes per block. This cap defined the maximum extension of the visible universe per quantum of time.[4]
Layer 1 is the variable layer. It can change via soft fork without breaking L0. L1 governs how the visible universe is priced, encoded, and extended. L1 is the dark universe: data stored permanently but priced differently, invisible to old validators, creating externality that the fee market cannot see.
The L1 variables:
SegWit weight accounting. How bytes are priced. Before SegWit, one byte = one weight unit. After SegWit, non-witness bytes count as 4 weight units; witness bytes count as 1. The total block weight is capped at 4,000,000 WU.[5]
The witness discount. The fee market unit. Witness data is priced at 0.25× in the vbyte calculation. The fee market quotes fees in sat/vB. The network stores raw bytes. The two units have diverged.
Taproot / MAST. Script expressiveness. A spending condition can be hidden behind a Merkle root; only the branch taken is revealed. The spending rules are consensus-critical but partially invisible.
Schnorr signatures. Signature aggregation. Multiple keys can produce a single signature. The cryptographic proof is smaller but carries the same authorization weight.
Address encoding. Bech32, bech32m. Purely syntactic. Changes how humans read addresses, not how the protocol validates them.
L1 is not optional in the way a language version is optional. The witness data that L1 introduces is consensus-critical: it contains the signatures and script proofs that authorize every spend. Every full node stores it permanently. But L1 data is priced at a fraction of L0 data in the fee market, and it is invisible to pre-SegWit nodes. The dark universe is real. It is just invisible to the old instrument.
L0 + L1 = a specific version of Bitcoin. The plus sign defines the boundary: which changes preserve L0 and which break it.
A soft fork tightens L1 within L0’s constraints. Pre-SegWit nodes still validate. The visible universe appears unchanged from inside. The boundary is preserved. Taproot was a soft fork: it added a new witness version inside the existing weight cap. The L0 invariants held.
A hard fork expands L0 itself. Pre-SegWit nodes reject the new blocks. The universe splits. The boundary is broken. A block size increase from 1 MB to 2 MB would be a hard fork: it changes the write authority, which is an L0 invariant.
SegWit was deployed as a soft fork. But it did something unusual: it layered L1 into the same block. The witness data was moved out of the serialized transaction and into a new witness section, but it still occupies the same block, is still stored by the same nodes, and is still consensus-critical. The soft fork label is technically correct — pre-SegWit nodes still accept blocks — but the effect was to expand the physical block from ~1 MB to ~4 MB of raw data while leaving the L0 vsize cap at 1 MB.
The 4× expansion is L1 only. Dark Bitcoin. L0 stayed at 1 MB. The pre-SegWit node’s universe is preserved. But the network now carries three megabytes of dark data per block that the fee market prices at one-quarter of its storage cost.
From the inside, the pre-SegWit node’s universe appears unchanged. It receives blocks stripped of witness data. The stripped block is ≤ 1 MB. The transactions look identical. The supply schedule is unchanged. The fee market quotes sat/byte. The write authority is still 1 MB per tick.
But the node is blind. The witness data that proves the spender has the right to move those satoshis is invisible. To a pre-SegWit node, a SegWit output’s scriptPubKey is the byte sequence 0 <20-byte-hash>. The old software pushes 0 and the hash onto the stack and the script ends. It resolves as anyonecan_spend — no signature required, no witness data consulted, no authorization checked.[4]
If a miner includes a block with invalid witness signatures, post-SegWit nodes reject the block. Pre-SegWit nodes accept it. They have no mechanism to detect the fraud. They would continue building on a chain that the rest of the network considers invalid.
The pre-SegWit node lives in L0. The L1 universe exists around it but is invisible. The node cannot see the three megabytes of dark data. It cannot know that the validation burden for post-SegWit nodes has quadrupled. It cannot know that the fee market has decoupled from persistence cost. Its instrument — its consensus rules — was not designed to detect the expansion.
This is exactly the dark energy analogy: the visible universe (1 MB stripped block) looks the same, but the underlying geometry (4 MB weight cap, witness discount, decoupled fee market) has expanded silently. The pre-SegWit node is an observer inside a universe whose expansion it cannot measure.
The vbyte unit prices L0 and L1 data at different rates. A witness byte costs one-quarter of a non-witness byte in vbytes, but the same in raw bytes, in disk, in RAM, in bandwidth, and in validation. The discount is applied to the price signal. It is not applied to the object.[4]
Take the simplest case. A 1 MB inscription, wrapped in a witness structure, packed into a single transaction. The writer pays a fee denominated in sat/vB. The transaction’s vsize is approximately 0.25 MB: 1 MB of raw witness data divided by four, plus a few hundred bytes of non-witness overhead. The writer pays for 0.25 MB. The network stores 1 MB. The 0.75 MB in between is uncompensated.
This is not a thought experiment. Block 836,903 (height 2024) stored 3,993,936 bytes of raw data while invoicing senders for 994,608 virtual bytes. The fee market billed for 1 MB; the network wrote 4 MB to disk.[6]
The fee market cannot tell L0 from L1. It sees one block, one vsize, one price. But the block has two layers with different persistence costs and different fee-market pricing. The 0.75 MB gap per MB of witness data is the L1 externality: the dark universe’s debt, transferred to every node operator, forever.
The chain has filled to 99.5% of the witness-discounted cap in the current 2024–2028 halving epoch. The constraint is binding. The price signal is wrong. The chain has reached the limit of what the witness discount will permit, and it has done so without ever making the writer pay for the persistence of the bytes the writer is enshrining.
Restore uniform byte accounting. Set WITNESS_SCALE_FACTOR = 1. Every byte counts equally, regardless of layer.
Under this rule, the vbyte becomes the raw byte. The fee market’s price signal aligns with the persistence cost. A 1 MB inscription costs 1 MB of fee, not 0.25 MB. The writer pays for the bytes the network stores. The 0.75 MB gap closes.
This is the rule the protocol already implies. The pre-SegWit code path encodes it directly: MAX_BLOCK_SERIALIZED_SIZE = 1,000,000. The post-SegWit code path encodes it in two steps (weight cap divided by witness scale factor), and the witness discount is what lets the two steps drift apart from the raw-byte accounting the storage cost actually depends on. The fix collapses the two steps into one.[4]
The fix does not change L0. The 1 MB write authority stays. The 21M cap stays. The UTXO model stays. The script validation stays. What changes is L1’s pricing: the witness discount is removed, and every byte is priced at 1× in the fee market. The dark universe is still there — the witness data is still consensus-critical, still stored permanently, still validated by every node — but it is no longer discounted. The fee market can finally see it.
The L0/L1 distinction clarifies the project’s existing treatment of SegWit, block size, and the witness discount. Several articles conflate the two layers. The corrections below reframe the existing arguments without changing their conclusions.
Line 167: “Raw block size has been unbounded since 2017” should specify L1 only. The L0 vsize remains capped at 1 MB. The L1 raw block size has been permitted up to ~4 MB since 2017. The 4× inflation is entirely on the L1 side.
Line 210: “The validation burden has quadrupled” should specify for whom. Pre-SegWit nodes never see L1 data and thus have no quadrupled burden. Post-SegWit nodes validate four times as many bytes — the full L1 payload including witness data — while pre-SegWit nodes validate only the L0 subset.
Line 136: “Bytes fit into a 4 MB weight envelope” should distinguish the fee-market-priced surface (vsize ~1 MB) from the physical object (raw size ~4 MB).
Line 167: “Increased the effective memory extension per block from approximately 1 MB to approximately 4 MB” should specify that L0 vsize stayed at ~1 MB while L1 raw block size expanded to ~4 MB. The informational invariant of 1 MB was broken only on L1.
Line 173: “The fee market billed for 1 MB; the network wrote 4 MB to disk” should specify that the 4 MB includes the ~1 MB of L0 data. The fee market billed for ~1 MB (L0 vsize); the network wrote ~4 MB (total), of which ~3 MB was L1 witness data priced at one-quarter of its storage cost.
Line 852: “SegWit altered this structure by redefining how transaction data is weighted” should note that SegWit preserved the L0 informational invariant (vsize ≤ 1 MB) while introducing a new L1 accounting dimension (block weight) that permits raw block size up to ~4 MB.
Line 870: The formula “≤ 4 MB/block” should note that this is the L1 maximum (raw block size). The L0 maximum (vsize) remains ≤ 1 MB/block.
Line 3506: “The full memory-width of a Bitcoin block is defined by protocol as up to 4 MB” should break this into ~1 MB L0 (non-witness, priced at full rate) + ~3 MB L1 (witness, priced at 0.25×). The 4 MB figure is the total physical storage burden; the 1 MB figure is the economic surface.
Line 60: “The block went from 1 MB to 4 MB” should specify that L0 stayed at ~1 MB (vsize) and L1 expanded to ~4 MB (raw size). The 75% discount is an L1 pricing artifact, not an L0 change.
Line 327: “Weight replaced bytes as the accounting unit” should specify that weight replaced bytes for L1, while L0 continued to use vbytes. The L1 raw block ceiling climbed from ~1 MB to ~4 MB; the L0 vsize ceiling remained at ~1 MB.
Line 156: “1 MB pre-SegWit, 4 MB post-SegWit weight” should note that pre-SegWit there was no L0/L1 distinction (the 1 MB cap applied to raw bytes). Post-SegWit, L0 vsize ≤ 1 MB, L1 raw size ≤ ~4 MB.
Line 203: “1 MB pre-SegWit, up to 4 MB post-SegWit” should note that pre-SegWit L0 = L1 (1 MB). Post-SegWit, L0 vsize ≤ ~1 MB, L1 raw size up to ~4 MB.
bitcoin-identity.html consistently distinguishes L0 from L1 throughout. block-layout.html:292 explicitly splits “roughly 1 MB of legacy data plus up to 3 MB of witness data.” ledgered-universe.html:137 parenthetically distinguishes “4 MB (1M vbytes under the witness discount).”