Review finding: bounded30 FORS+C index is 112 bits and the signature cap is wallet-local #261

Summary

The bounded30 profile's FORS+C omits one 16-bit tree (7 x 16 = 112 bits), and the 2^30 signature cap is a wallet-local call counter, not part of the signature.

Observed

SPX_FORS_TREES=8, SPX_FORS_SIG_TREES=7, SPX_FORS_HEIGHT=16. The wallet counter is not committed; signrawtransactionwithkey starts a fresh counter map per call. Two distinct messages with the same (tree, leaf) appear around 83k signatures; the post-FORS path is byte-identical.

Impact

The 128s label overstates the FORS index margin; a raw-key signer can exceed the cap, and repeated use of one leaf lowers the margin further.

Suggested fix

Persist a durable counter for raw-key signing; commit the counter or lower/rotate the cap for high-value keys; use a wider profile where the 112-bit margin matters.

Evidence

src/crypto/pqc.h:31; src/crypto/pqc.cpp:107-122; params-sphincs-sha2-128s-bounded30.h:70-72; src/rpc/rawtransaction_util.cpp:44-84; src/script/signingprovider.cpp:201-226; doc/consensus/p2mr-v1.md:423. Collision PoC: /home/ubuntu/audit/scratch/qbit-pqc/.