Plan the vault
Two leaves under a NUMS internal key (no keypath bypass possible): the heartbeat leaf the owner can always spend, and the heir leaf that unlocks only after n blocks of inactivity.
Owner key
Heir identity
Inactivity threshold
OP_CHECKSEQUENCEVERIFY is 16-bit: a "one year" setting is impossible and is refused, not silently truncated.
Vault address
Descriptor (share with the heir — recomputable; NOT signed — verify against the published address)
Vault spec (JSON — keep this; it re-derives everything)
The vault
Load a vault spec to see the address, the descriptor, and what each key can do. The spec re-derives everything and refuses tampering loudly.
Vault address
Watch
Read-only. Blockbook is only ever fetched with GET — never trusted blindly: every returned UTXO's script is checked against the vault contract before it is believed.
Status
UTXOs
| txid:vout | value | funded at | age | status |
|---|
Claim & refresh
Both transactions are built and signed locally. Nothing is broadcast until you explicitly confirm — twice.
Heir claim
One claim transaction spends one vault UTXO via the heir leaf (nSequence = n, hard-coded). Repeat per UTXO.
Owner heartbeat refresh
Spends every vault UTXO via the heartbeat leaf and forges a single fresh UTXO at the SAME vault address. The new coin's funding height restarts the heir's inactivity clock — identical keys + n always produce the same address, by design.
Heartbeat confirmed
Signed transaction
Standalone verifier
Paste a legacy:v1:… descriptor and the address it claims to describe. The page recomputes the contract from the keys + n and refuses loudly on any mismatch — the descriptor itself is not signed, so the claimed address must come from a source you trust. No keys needed — verification is trustless.
Honest limits
- Inactivity is measured in blocks, not days — day figures are estimates at 194 s/block and the chain enforces blocks only.
- n is capped at 65535 blocks (~147 days) by OP_CHECKSEQUENCEVERIFY's 16-bit field. Longer lockups are impossible, not silently shortened.
- The heir can claim only after n blocks of UTXO age — any owner refresh (heartbeat) restarts the clock. Watch the chain; a stale page lies.
- Blockbook is read-only and never trusted blindly — every UTXO script is re-checked against the vault contract.
- The descriptor is not signed — anyone can mint a valid-looking one for a different vault. Verify it against the address it was published with.
- Heartbeat refreshes pay the same vault address — a different address means different keys or a different n.
- The builder tip is optional and heir-claim-only: 1% of the claimed UTXO, only when the heir checks the box, paid as its own output to the builder address printed next to the checkbox. Refreshes never carry one — a refresh output must pay the vault itself.
- This page never moves PRL by itself: every broadcast needs your explicit double confirmation.
- Lose both keys and the funds are unspendable. The heir needs the descriptor and their key.