QSAVE is a post-quantum transition solution that avoids burning coins. I have tried to incorporate the feedback I received on my earlier posts. The proposed solution is laid out in five draft BIPs, with MediaWiki sources at https://www.qsave.org/legal/bip-suite.

Earlier posts were: [BIP Proposal] No burn, Quantum Migration Proposal, Quantum Secure Asset Verification & Escrow (QSAVE)

1. bip-qsave-conditional-spending: classifies every spent input and sends spends without a second factor to recovery.

2. bip-qsave-watermarks: pre-cutoff commitments and the registry of accepted second factors.

3. bip-qsave-seed-derivation-factor: a zero-knowledge proof that one seed derives both the spent script and the post-quantum authority.

4. bip-qsave-protective-recovery: the lost-property output and the two ways it is released.

5. bip-qsave-p2mr-zkstark: a zk-STARK spend leaf for BIP 360 P2MR outputs.

QD5 is an optional source-matched authority profile using an independently backed-up ML-DSA-87 key. It can be admitted as an automatic-factor route, but it is not required for every coin unless a later consensus deployment marks it mandatory for a defined source class. That marking would send inputs without QD5 or an accepted replacement factor through protective recovery.

QSAVE is an alternative to BIP 361 or Hourglass for handling coins left behind in a post-quantum chain migration. It has no sunset or burn; instead, it proposes a lost-property process. The scheme can be implemented in the 'do-nothing' scenario by making white-hat hacking legal where the intent is to protect the coins. I hope a soft fork can be agreed upon that would make transfer to lost-property addresses the only output possible for a non-migrated address after a certain block height. If such a soft fork cannot be agreed upon, we would be in a quantum safari situation, with white-hat hackers competing with black-hat hackers and a great deal of law-enforcement activity, which would be unfortunate.

Our proposal is to add a second factor that provides a quantum-resistant proof of ownership. After a certain block height, coins can no longer be spent with their ECC key alone. The script and its signatures are still required as factor one, but a second factor is also needed, such as a proof that the address derives from the wallet seed, or a post-quantum binding record committed before the cutoff height.

If the second factor is missing, the coin can only be moved to protective recovery: a lost-property address that allows a longer recovery period. During the recovery period, which might be indefinite for some coins, the policy may direct returns to charities. This is along the lines of the Dormant Assets Act 2022 in the UK; the legal and economic treatment remains outside Bitcoin consensus.

The design is intended to provide three things:

1. The existing private key is still required, quantum-derived or not, so nothing happens faster than it would in the do-nothing branch.

2. A missing second factor never burns the coin; there is no sunset.

3. An on-chain asymmetric proof of ownership spends the coin directly with no third party, or an off-chain route can eventually recover it through a lost-property office and an evidentiary procedure.

From the enforcement height (which consensus can switch on at any time), ordinary validation runs first. Each input of a valid transaction is then classified. POST_QUANTUM_NATIVE inputs match an entry in the activated native-path registry and are authorized by that path's own rules. Everything else is UNMIGRATED_TWO_FACTOR_REQUIRED, including unknown and future script types. If any unmigrated input lacks a valid second factor, every spendable output must be a recovery output. A set of decentralized custodians hold recovery outputs, with a backup custodian and a veto controller. This keeps funds decentralized while avoiding capture by an errant actor. Funds held as lost property can earn conservative returns (0.5%) that can be directed toward charitable purposes.

Recovery from this state may be automatic if you provide second-factor information. If no on-chain second-factor information is available, you must undertake evidence-based recovery. This way, all coins, including early Satoshi-era coins, can earn money for charity and be reclaimed in perpetuity. Although this is no longer a permissionless process (humans are involved), all the other routes lead to human (usually law enforcement) involvement, so we think this is the better consensus approach. If Bitcoin doesn't resolve this problem, someone else will do it for us, and that is unlikely to be a good outcome. 

Thanks,

James Tagg