The cost of a rewrite

• Reforge. Re-mine a block and every block after it, so the register becomes internally consistent again. CHAIN.reforge(chain, index, difficulty).
• attempts. The field reforge returns alongside the rebuilt chain. It is the total across every block it re-mined, not a per block figure.
• Draw. One block's search for a qualifying nonce. Independent of the last one, with no memory and no progress.
• Depth. How many blocks sit on top of the entry you want to change. The count of blocks to redo is exactly that number plus the block itself.
• Confirmation. One block added on top of the block holding your entry. Counting them is counting depth.
• Finality. The point at which a rewrite stops being worth worrying about. A probability that strengthens, not a line that is crossed.
• Mean. An average over many independent blocks, quoted with its trial count. A single run is not one.
• Spread. How far individual runs sit from the mean. At difficulty 3 the measured range ran from 40 attempts to 17,343.

The first total means almost nothing on its own. Press the same button a second time at the same difficulty and watch the total land somewhere else entirely, sometimes by a factor of several. Same register, same edit, same difficulty, same four blocks. Four fresh draws.

That is the correct mental model of a rewrite cost, and it is why a single measured figure is not a number you should quote to anybody. It is one sample of a quantity with an enormous tail.

Worth being exact about, because it is easy to mistake for a trick. The nonce search itself is not random: it starts at zero and counts upward, so searching the identical bytes twice finds the identical nonce after the identical number of attempts. Re-running a fixed model gives a fixed answer, which is the same reproducibility that lets session 2 print hashes in a diagram.

What varies between runs is the block being searched. An attacker forging blocks 2 to 5 writes their own timestamps into them, and the box does exactly that, stamping a different second on each forged block each time you press it. Different bytes, different search, an independent draw per block. That is what a real block does anyway, since no two blocks ever carry the same contents.

Starting at the index you give it, reforge copies the chain, then walks forward. For each block it sets prev to the hash the block below it now has, searches for a nonce that satisfies the difficulty, stores the new nonce and the new hash, and adds that block's attempts to a running total. When it reaches the end it hands back the rebuilt chain and one number.

Note the order. Block 3 cannot be mined until block 2 is finished, because block 3's prev is an input to block 3's hash. The four draws are independent in their outcomes and strictly sequential in their execution, and that distinction does real work in session 8.

Run CHAIN.verify() on the reforged chain and it returns ok. Every hash recomputes, every link matches, and the entry at block 2 now says whatever the attacker wanted it to say. Nothing inside the register objects.

This is the uncomfortable half of proof of work and it is worth being blunt about it. Work does not make a rewrite detectable. Session 3 already made it detectable, with no work at all. Work makes a rewrite expensive, and expensive is a completely different property from visible. A reader holding only the rewritten register sees a perfect chain.

Both things are true and they sound contradictory. In absolute terms four draws swing further than one, because one unlucky block is enough to blow the total out on its own and there are now four chances of that happening. In relative terms four draws are steadier than one, because a very short draw and a very long draw can land in the same total and partly cancel.

So a four block rewrite is a little more predictable as a proportion of itself and a lot less predictable as a raw count. Neither of those makes any single run a cost estimate. Run the box several times at difficulty 2 and write the totals down before you believe anything about them.

Read the mean column downward: 16, then 277, then 4,115, then 74,190. Each row is roughly sixteen times the one above it, because one more required leading zero divides the qualifying hashes by sixteen. The difficulty dial is not a slider with linear notches, it is an exponent.

That is what makes difficulty a usable defence at all. A modest increase in what one block costs honest writers is a huge increase in what four blocks cost an attacker, and both sides feel it, which is the trade the next card is about.

One camp holds that this cost is the security. The register is safe to the extent that redoing it is expensive, the expense is measurable, and a threat model can be written with the measurement in it. On that reading, work is the thing that turns a detectable edit into an edit nobody will attempt, and everything else is commentary.

The other camp holds that cost is the wrong unit entirely. Honest writers pay the cost continuously, for as long as the register is in use; an attacker pays it once, for the short window they care about. A quantity that one side pays forever and the other side pays once is not a fair comparison, and calling it security smuggles in an assumption about the attacker's budget that nobody has checked.

Both camps agree completely about the arithmetic on this page and disagree about what the arithmetic licenses you to claim. It is worth knowing which one you are talking to before agreeing that a chain is secure, because they mean different things by the word.

When a register is described as waiting for six confirmations before an entry is acted on, that is this arithmetic being used as a policy. Six confirmations means six blocks have been written on top, so a rewrite now has seven draws to win instead of one, and each of those draws is the full price at the current difficulty.

The choice of six is not a property of the mathematics. It is somebody deciding how much residual risk they will carry, on what they are willing to lose, and reasonable people pick different numbers for different consignments. Treat any confirmation count you are quoted as a risk appetite, not a fact.

A draw with an enormous tail can always come in short. Difficulty 3 has a mean of 4,115 attempts and it has produced a block in 40. There is no depth at which the chance of a lucky sequence becomes zero, only depths at which it becomes small enough that nobody reasonable would plan around it.

So the honest sentence is that an entry gets harder to move every time a block lands on it, without limit and without ever arriving anywhere. If somebody tells you a record on a chain is final, the useful question is what depth they mean and what they are willing to lose if they are unlucky.

Everything in this part assumes blocks keep arriving. Depth is accumulated by other people writing, and an entry in a register that has been quiet for a year is exactly as deep as it was a year ago. The protection did not grow; it stopped growing the moment the writing stopped.

Worth checking against whatever you are being sold. A private register with one writer and a handful of entries a month accumulates depth very slowly, so the cost argument that makes this structure interesting is doing almost no work there. The tamper evidence from session 3 still holds, and it holds at difficulty 0 for free.