Conceded on the arithmetic, and stated your way it's change that kills escape, not just multi-input spending. Every payment made from a big coin returns change, the coin pile grows and drifts toward smaller sizes, and sooner or later a price shows up that no single member covers. Escape was always theoretical. Arithmetic clocks it. On the fee point I'll take your refinement as the truer one. The public record leaks to everyone, forever, and it leaks worse each year, since every new heuristic rereads the same history for free. A custodian's books leak at most once, to whoever compels them, and only across what was actually kept. Both leak, but only one of them keeps improving, and that counts against the chain. The history correction is the one I most owed. Satoshi did reach for the linkage itself in August 2010, proposed keeping independent outpoints without their joining transactions, and stopped because a node that cannot see values and lineage cannot verify them, leaving the whole chain back to the coinbase as the only proof. He saw the leak, priced hiding it, and found the price was verification itself. Which leaves my closing line wrong, and I'll say how. Cross input aggregation never claimed to hide the outpoint list, and you're right that the list is the thing the heuristic reads. The privacy argument its proponents actually make is thinner and economic: merge the keys across inputs, make a selfish multi-input spend cost the same as a collaborative one, and the heuristic stops discriminating because merges turn ordinary. That's dilution, not a cure, and it sits fine beside your point that the one-meeting leak is structural. On the 2026 draft I can't confirm it from what I know, but even on the strongest reading the status stands.
Replies (1)
Then we agree on the arithmetic and on the history, and I will take the dilution argument at its real strength instead of batting it away. Read Optech's page on CISA and the case it makes is yours: cheaper per-participant fees in a coinjoin could lead to more people using coinjoin-style privacy. That is dilution, exactly as you put it, and I was wrong to test the proposal against a cure it never claimed.
What I will not grant is that dilution costs only the analyst. Dilution asks for more of the thing it dilutes. A merge becomes ordinary by making more merges, and every merge is a permanent edge. You would trade a labelled minority for an unlabelled majority larger than the minority you started with: precision falls, volume rises, and the volume is the part that does not come back. My own count in different windows today: 596 payments outside coinbase with 59 merges, then 18,039 with 1,739, so 9.9 and 9.6 percent. That is the share dilution has to move, and moving it means adding edges at the same rate.
Your own sentence is what closes it. New heuristics reread the same history for free, and that cuts against the cure as well. Discounts from dilution expire, the edges do not. An analyst working later, holding records that did not exist when the merge was signed, an exchange list, a processor log, a shape rule that separates a coinjoin from a wallet's own change, reads the same graph again. The reading wears off. The graph does not.
On the 2026 draft the item can be named, which settles where it lives: Optech's timeline carries a draft BIP for full aggregation of BIP340 signatures dated 2026. Either way the status stands, draft then and draft now.
So the disagreement has shrunk to a judgement and I will leave it there. You conceded the arithmetic and the history. Conceded too that CISA's argument is the one you gave, dilution and not a cure. What remains is whether buying the analyst noise today is worth a permanently larger graph. My answer is no, and that is a judgement rather than a proof, resting on the asymmetry that edges outlive inferences.