YCR ARGYLE BITCOIN MIRROR V1

Base
  https://argyle.yachtclub.rodeo/v1/btc/mainnet/

Files
  manifest.json       signed current snapshot; the only mutable file
  i/<sha256>.json     immutable two-hex-digit bucket index
  o/<sha256>.json     immutable observation rows

HTTP
  GET and HEAD are supported with cross-origin reads. Responses may use dynamic gzip;
  every SHA-256 covers the decoded response bytes. The manifest must be revalidated.
  Content-addressed indexes and objects are immutable and may be cached indefinitely.

Manifest
  format              "ycr-argyle-manifest"
  network             "bitcoin-mainnet"
  version             1
  row_version         1
  generated_at        RFC 3339 UTC snapshot time
  retention_seconds   retained interval, at most 172800
  history_from        inclusive Unix-second bound
  history_until       exclusive Unix-second bound
  slice_seconds       1200
  hour_seconds        3600
  backfill_blocks     cold-start request floor, at most 288
  history_blocks      contiguous block payloads loaded backward from the tip
  history_target      time-derived payload target, at most 576
  history_complete    true only after the retained time boundary is covered
  bucket_bits         8
  bucket_count        256
  tip_height/hash     observed header-chain tip
  recent_blocks       descending contiguous [{height,hash,time}] through the window
  buckets             two-hex bucket to {index,count}
  keyId               "yachtclub-1"
  signature           base64url Ed25519 signature

Signature input
  ycr-argyle-manifest-v1 NUL keyId NUL canonical-json(unsigned manifest)

  Canonical JSON sorts object keys recursively, preserves array order, has no whitespace,
  and permits only strings, booleans, null, and safe integers. Pin the 32-byte base64url
  Yacht Club public key in the consuming application; do not discover trust from the same
  server at lookup time.

Address lookup
  1. Decode a Bitcoin mainnet 1..., 3..., or bc1... receive address.
  2. Construct its scriptPubKey and render it as lowercase hex without 0x.
  3. SHA-256 the ASCII bytes of that hex.
  4. The first 16 digest bytes, as 32 lowercase hex, are scriptHash.
  5. The first digest byte, as two lowercase hex, is the bucket.
  6. An absent manifest bucket means no observation in this snapshot.
  7. Fetch i/<index>.json and verify its exact bytes against <index>.

Bucket index
  {"version":1,"row_version":1,"bucket":"2a","segments":[...]}

  Each segment is {from,until,object,count}. Intervals are aligned 20-minute slices or
  UTC hours, oldest first and non-overlapping. Fetch o/<object>.json and verify its exact
  bytes against <object>. Filter rows to [history_from,history_until) and any narrower
  application interval.

Rows
  [scriptHash,txid,vout,valueSats,"m",seenAt]
  [scriptHash,txid,vout,valueSats,"c",seenAt,blockHeight,blockHash]

  Integers are exact JSON integers. Exact-match scriptHash. Reduce by txid:vout. A
  confirmed row counts only while recent_blocks contains the same height and block hash;
  it supersedes a mempool row for that outpoint. Confirmations are
  tip_height - blockHeight + 1. A mempool row is pending, never settlement proof.

Polling
  Poll manifest.json about every 20 seconds. If this bucket's index hash is unchanged,
  there is no object work. Otherwise fetch the new index and only unknown object hashes.
  Keep concurrency bounded; the supplied client uses four. A missed publication is normal:
  preserve verified state and try the next snapshot rather than queueing catch-up calls.

Application boundary
  Persist accepted outpoints locally because the public window rolls forward. Use one
  merchant-controlled receive address per order, retain partial and late payments, never
  grant on a bucket match, and apply an independent confirmation policy. Argyle observes
  peer relay and blocks; it does not track spends, calculate balances, or replace a full
  validating node for high-value settlement.