Root is a Merkle based epoch distributor. It runs in fixed windows of on chain time called epochs. While an epoch is open, every wallet accumulates entitlement according to a rule that gets locked in before the epoch starts and never moves while it is running.

When an epoch ends, every wallet's final entitlement for that period gets hashed individually into a leaf. Leaves get paired and hashed together, and those results get paired and hashed again, repeating until a single hash remains. That final hash is the root, and it gets published on chain in one transaction, the same size whether the epoch had ten wallets or ten million in it. Nobody needs to see the full list of entries to trust the outcome.

Claiming a share does not require the whole tree. A wallet submits its amount along with the handful of sibling hashes connecting its own leaf to the root, roughly the base two logarithm of the total number of entries in that epoch. The claim instruction rehashes the wallet's leaf, walks it through the supplied hashes, and checks whether the result equals the root already stored on chain. If it matches, payout happens in the same transaction. If it does not, nothing is paid, and there is no partial outcome in between. A bitmap account tracks which leaves have already been claimed, so the same proof cannot be submitted twice against the same epoch.

Once an epoch's claim window closes, anyone can permissionlessly trigger rollover for it. The instruction computes what went unclaimed as the epoch's total pool minus everything actually claimed against it, and adds that remainder directly into the next epoch's pool, before that epoch's own tree is even built. The caller who triggers this gets paid a small fixed reward for doing it. Nobody has to remember to act on this. The reward is what makes it happen without depending on anyone's goodwill.

Unclaimed value never sits waiting for an operator to reclaim it, because no such operator exists in the claiming path. It reenters the next epoch's pool and becomes indistinguishable from everything else accumulating there, available to whoever is still checking. This is the entire mechanism by which presence gets rewarded. Absence is not punished directly. It simply does not hold a place in the next distribution unless someone claims it before rollover happens.

No wallet can publish a root that does not match its own leaves, because the root is a deterministic output of those leaves, not a claim made by a signer. No key can revise a root once it is published, and no instruction exists that can reopen a closed epoch. There is no pause function and no privileged account with authority over the sequence of epochs. The program itself has no upgrade authority. It was removed permanently once deployment finished. If everyone who built root disappeared tonight, the next epoch would still close on schedule, still roll its unclaimed leaves forward, and still publish its root exactly the way every epoch before it did.

There are two edges to this worth stating plainly. If every leaf in every epoch gets claimed, nothing ever rolls forward, and each epoch's pool starts from zero. That is a complete and valid outcome, it just means nothing accumulated beyond what that epoch generated on its own. If nothing is ever claimed, the unclaimed total compounds forward without limit, epoch after epoch, indefinitely, provable at every stage under a fresh root each time it rolls, until someone eventually submits a proof against it. Whoever does inherits whatever built up in the meantime, not because the system singles them out, but because it was never built to hold anything for itself. It only carries forward what has not yet been claimed.

The one condition all of this depends on is the entitlement data feeding each epoch's tree. That data has to come from something any third party can independently derive from public on chain state, such as a wallet's balance snapshotted at a specific slot, rather than a number someone simply hands over. The claiming mechanism is sound regardless of how that data was produced, since a proof either matches the published root or it does not. What is not automatically trustless is the process of building the tree in the first place, and root does not pretend otherwise. That is the one place it asks to be checked rather than believed outright.