How can a Taproot output be spent?

How does the mechanism work?

Taproot uses Schnorr signatures and a commitment construction that can hide unused script branches. A script-path spend reveals the path being used rather than publishing every alternative script in the commitment.

A key-path spend does not announce a full list of possible fallback scripts. Whether an output is spendable that way depends on its construction and the required signing authority. The diagram shows the alternatives, not a universal wallet setup.

A commitment can conceal unused alternatives while still making the chosen path verifiable. The spender does not get to invent a new leaf script after seeing which outcome is convenient. The proof must connect the revealed choice to the output’s earlier construction. This is a useful distinction between selective disclosure and unrestricted editing. A diagram showing branches should therefore be read from creation to spending: commit to the permitted possibilities, then reveal and satisfy one of them. Whether the participants retained enough information to use every intended recovery path is an operational question beyond the fact that the commitment is mathematically well formed.

What bytes distinguish key and script paths?

A standard Taproot output uses a version-1 witness program containing a 32-byte output key. That key represents a construction that can commit to script alternatives. A key-path spend supplies a Schnorr signature rather than revealing those alternatives. The default signature encoding is 64 bytes; an explicit non-default signature-hash type adds a byte under the specified rules.

For a script-path spend, validation needs the selected script and a control block connecting it to the output key. The control block is 33 + 32 × m bytes for a Merkle path of m nodes. In a worked structural example with m = 2, its length is 97 bytes. This counts only the control block, not the script, satisfaction arguments or the rest of the transaction.

Follow that example from output to input. The output publishes the tweaked key. Later, the spender reveals a selected leaf script and its sibling hashes through the control block. A node reconstructs the commitment and checks the executed script. Unused branches are not published as full scripts, although the proof still reveals structural information and the chosen spending path.

The key path and script path are alternative ways to satisfy one output. They do not allocate separate pots of coins. Once a valid spend consumes that output, another path cannot independently spend it again in the same accepted history. A design may make cooperative spending compact while keeping a fallback, but its exact key construction and recovery requirements remain part of the design.